Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Is Probably Not Stealing Your Files

one.darrenpmeyer.com

Post reply on HN
Print view View original

31–40 of 105 posts

Re: Dropbox Is Probably Not Stealing Your Files

#31

Post by ProAm »

whizzkid wrote: post #19

" 1 - Create a large-ish file (1MB) outside of the Dropbox folder 2 - Monitor the network usage of the Dropbox application to see if it sends enough data that it could be that file " I can not really say if Dropbox steals them or not. But if i were a Dropbox engineer and want to know about those newly created files, i wouldn't want to send the whole file to server at all. - Send file name with its extension - Send fi…

And they don't have to steal the whole file at once, why not chunk it out and do bits at a time over a few days. This is tinfoil hat territory, but they'd still get the file and network traffic wouldnt be overly suspicious.

Re: Dropbox Is Probably Not Stealing Your Files

#32

Post by cbhl »

[deleted] wrote: post #24
tptacek wrote: post #4

This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure". Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything l…

[deleted]

Dropbox for Linux runs just fine as a user-mode program.

Besides, Dropbox does much nastier stuff than look at your files; it bloody hooks into your shell (Finder/Explorer) and manipulates the icons. It could decide to replace an .exe icon with the icon for a Word Document, for example.

Re: Dropbox Is Probably Not Stealing Your Files

#33

Post by rawnlq »

tptacek wrote: post #4

This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure". Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything l…

Previous (successful) attempts at reverse engineering: https://www.usenix.org/conference/woot13/workshop-program/pr...

Re: Dropbox Is Probably Not Stealing Your Files

#34

Post by microtonal »

sarciszewski wrote: post #2

Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…

Hey, this file matches one that the FBI/NSA is looking for via NSL.

Or why not more mundane: another user shares a file with you. Dropbox knows that you already have the same file somewhere on your filesystem outside the Dropbox folder (or a partial match). It doesn't have to transfer that data to you.

But I agree with those saying it's probably a result of some implementation issue (Finder extension or working around some shortcoming in monitoring just the Dropbox directory).

Re: Dropbox Is Probably Not Stealing Your Files

#37

Post by raverbashing »

chinathrow wrote: post #29

"This is, by necessity, a system-wide process." This is, by design, a fucking huge defect of the underlying system calls. Give the OS a list of folders to watch. Dropbox should not even get a callback for a file it's not is supposed to watch.

See: inotify in Linux

Re: Dropbox Is Probably Not Stealing Your Files

#38

Post by jjarmoc »

microtonal wrote: post #34
sarciszewski wrote: post #2

Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…

Hey, this file matches one that the FBI/NSA is looking for via NSL. Or why not more mundane: another user shares a file with you. Dropbox knows that you already have the same file somewhere on your filesystem outside the Dropbox folder (or a partial match). It doesn't have to transfer that data to you. But I agree with those saying it's probably a result of some implementation issue (Finder extension or working aroun…

This is pretty close to how their deduplication used to work, and isn't too different than how rsync works.

Of course, this gave rise to the ability to transfer files (even non-public files) quickly between Dropbox accounts provided knowledge of the hashes of its chunks, and Dropbox has since changed their deduplication. See https://github.com/driverdan/dropship

Re: Dropbox Is Probably Not Stealing Your Files

#39

Post by chisleu »

Read their TOS and compare it to Google Drive's TOS.

The insane rights the Google TOS grants to Google are why it costs ~ 1/2 as much.

It is also an indicator that Dropbox is less shady. They don't grant themselves rights to do anything with your data outside of the normal things you need them to do to offer the dropbox service for your use.

Unlike Google, which could for instance, use your personal photos of your kid eating ice cream to try to sell you ice cream via road side LED billboards.

Re: Dropbox Is Probably Not Stealing Your Files

#40

Post by bebbiwebbi »

"The Dropbox application uses a filesystem monitor to detect when changes are made by monitoring filesystem write events. This is, by necessity, a system-wide process. So DLP alerting that Dropbox is “acccessing” a new file shouldn’t be surprising."

I think this SHOULD be surprising to any competent software engineers. That isn't how the file system watcher works.

Post reply on HN