Dropbox Lack of Security • Hacker News Board

Re: Dropbox Lack of Security

#181

Post by Pahalial » Tue, Apr 19, 2011, 10:40 PM UTC

donpark wrote: post #139

latch wrote: post #124

Earlier quoted context omitted.

Agreed. Except a lot of companies have a lot of " financial incentives at stake to be diligent security wise" but aren't. Something I very recently heard: "World of Warcraft has had RSA-style two-factor token authentication for years, and my bank still doesn't"

Some thoughts re WoW vs banks: WoW Authenticator is optional, costs $30~40, and intended for serious WoW players in a community with very strong peer support. Banks can do first two but don't have a community of tech savvy users to reduce cost of support manageable. So Blizzard could but banks couldn't. Will this change? I think so but it'll have to be opt-in and paid for by customers, likely through third-party serv…

$6.50, not 30-40: http://us.blizzard.com/store/search.xml?q=authenticator - this omits the free apps for most smartphones.

As far as peer support, honestly, there's almost no peer support. There is a strong first-line of FAQs and automated systems (regularly ensuring secondary contact information is accurate, well-defined systems for lost authentication devices,etc) and well-trained second-tier tech support.

There are enough third-party auth providers now that would be well able to provide the entire support chain for the banks. In fact, Gemalto has built for this: http://www.gemalto.com/financial/ebanking/

Re: Dropbox Lack of Security

#182

Post by kgo » Wed, Apr 20, 2011, 12:05 AM UTC

tlrobinson wrote: post #44

bdhe wrote: post #43

Earlier quoted context omitted.

> because they make them available to you through the web interface. You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

And where would the decryption keys come from?

Hashing your passphrase a million times just most other decryption keys.

Re: Dropbox Lack of Security

#183

Post by kevinpet » Wed, Apr 20, 2011, 4:46 AM UTC

This is the second completely unreasonable press attack on Dropbox. They are so unreasonable that I have trouble believing a reasonable person would think they are valid complaints unless they were trying to sell me a competing product.

Everyone with any security sense knows: 1. If someone gains access to your computer, and they can read your hard drive, and your computer can automatically log in to some service, then they can log in to that service. 2. If you can access the data without decrypting it locally, then your service provider can too. In a fantastically secure system, they will have decide to do and then wait for you to log in, but that's pretty unusual.

I predict next week we will get an article pointing out that I can get your files by breaking into your email account and then using the reset password feature.

Re: Dropbox Lack of Security

#184

Post by dman » Wed, Apr 20, 2011, 4:59 AM UTC

jlouis wrote: post #105

Groxx wrote: post #78

Earlier quoted context omitted.

Have fun decrypting AES in Javascript, and downloading the file through your browser. (edit: on your cell phone...)

My Cellphone is as powerful as a 2002 state-of-the-art desktop machine. There are problems here, but this is not it.

Network latency and bandwidth is the new MHz.

Re: Dropbox Lack of Security

#185

Post by Groxx » Wed, Apr 20, 2011, 7:21 AM UTC

dman wrote: post #184

jlouis wrote: post #105

Earlier quoted context omitted.

My Cellphone is as powerful as a 2002 state-of-the-art desktop machine. There are problems here, but this is not it.

Network latency and bandwidth is the new MHz.

Actually, I think that may have been the one after MHz. Now we're into how many cores something has.

Re: Dropbox Lack of Security

#186

Post by newman314 » Wed, Apr 20, 2011, 7:57 AM UTC

mentat wrote: post #147

sunchild wrote: post #141

Earlier quoted context omitted.

It could be even simpler: Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed. When I started my own law practice, my partners insisted that "everything must be encrypted" so that no third parties would have access to see any files. I had a feeling my partners were parroting this requirement and didn't really understand how security works. I tried to explain the pros…

"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed" This is not the same as "is not accessible to employees". Interfaces are just that. There are quite a few very sharp developers at Dropbox if reputations are to be believed. I don't think an interface is a sufficient control.

Sharp developers != sharp developers who understand how to properly implement security into product.

I think it's been shown multiple times that smarts devs that do not do security all the time still are susceptible to making mistakes about security. IMO, this is one of those cases.

Miguel is right in calling for an audit but even better, Dropbox could just ask for help. I'm sure any number of savvy HN peeps would be happy to help.

Re: Dropbox Lack of Security

#187

Post by ugh » Wed, Apr 20, 2011, 8:28 AM UTC

jrockway wrote: post #179

ugh wrote: post #92

Earlier quoted context omitted.

We are talking here about Dropbox being simple to use for everyone and you start talking about keeping backups of keys. In safe deposit boxes, no less. Wow.

You don't need to worry about safe deposit boxes. Just don't be upset when you get a letter in the email from a law firm that's noticed some of the music in your dropbox has the same hashes as the music in someone else's dropbox. The cloud is a scary place. Making it easy to use is not necessarily a good thing.

De-duplication is not really the topic of this discussion, is it?

Re: Dropbox Lack of Security

#188

Post by TheSwede75 » Wed, Apr 20, 2011, 9:49 AM UTC

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

As an alternative to dropbox I would suggest taking a look at SpiderOak online backup and sync @ https://spideroak.com

Re: Dropbox Lack of Security

#189

Post by heyitsnick » Wed, Apr 20, 2011, 9:58 AM UTC

lean wrote: post #161

gergles wrote: post #55

I don't care. I use Dropbox because of the unparalleled feature set and ease of integration. I have my taxes stored on Dropbox, along with a lot of other sensitive information. They're in an encrypted RAR file with a line-noise passphrase, just like they would be if I were storing them anywhere (including locally -- after all, what if Mallory steals your hard drive? Or, to parrot the most common movie plot threat, wh…

> paying Dropbox customer here, I wouldn't call the features "unparalleled". SugarSync offers more, and for slightly less: https://www.sugarsync.com/sync_comparison.html ...or so I'm assuming. I never tried it because last time I checked they require a credit card for a free trial.

Seems like you can get a free 5g account without CC here:

https://www.sugarsync.com/signup?startsub=5

Re: Dropbox Lack of Security

#190

Post by stef25 » Thu, Apr 21, 2011, 3:42 PM UTC

palish wrote: post #52

shin_lao wrote: post #38

Earlier quoted context omitted.

I might have misunderstood what you meant, but #1 is invalid. If I can look at my data any time I want, I just need the key to it. Dropbox just gives me access to the encrypted stream. Giving access to my data to someone else would therefore just be a question of sharing the key with that person, again, without Dropbox ever having access to this key. Your killer argument is to me #3. If you don't trust a company, don…

One of the reasons Dropbox is successful is because anyone can use it. Even your mother. In fact, one of the reasons Drew was originally accepted into the YC program was because his sister was using it when he applied. "If I can look at my data any time I want, I just need the key to it. Dropbox just gives me access to the encrypted stream." In order for the data to be encrypted securely, you would need to generate a…

Funny, when I visit my mom I use her computer for emergency bug fixes and I have my Dropbox installed on her computer. Every now and then I'll see a notification about a document being added to my DB so I checked and it turns out she's saving her documents there cause she "likes the name of the folder".

So yeah, mom's can definitely use it.