Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox passwords optional for four hours

techcrunch.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Dropbox passwords optional for four hours

#41

Post by tptacek »

lawnchair_larry wrote: post #40
tptacek wrote: post #17

Earlier quoted context omitted.

Very yes (we don't allow Dropbox† on our machines, but we know of companies that rely on it). Grandalf's point is extremely well taken. It's actually true. Not only that, but regulated companies (in health care and finance) that have a reasonable belief that any of their systems might have had Dropbox on them technically need to audit now. I point this out not to bag on Dropbox, but as an illustration of how sane som…

Why not Tarsnap?

I like Tarsnap. If I had to recommend a 3rd party storage vendor, it would be Tarsnap.

Re: Dropbox passwords optional for four hours

#42

Post by lawnchair_larry »

tptacek wrote: post #41
lawnchair_larry wrote: post #40

Earlier quoted context omitted.

Why not Tarsnap?

I like Tarsnap. If I had to recommend a 3rd party storage vendor, it would be Tarsnap.

I know, but that doesn't answer my question. Why is it banned at your shop?

Re: Dropbox passwords optional for four hours

#43

Post by pavel_lishin »

lawnchair_larry wrote: post #42
tptacek wrote: post #41

Earlier quoted context omitted.

I like Tarsnap. If I had to recommend a 3rd party storage vendor, it would be Tarsnap.

I know, but that doesn't answer my question. Why is it banned at your shop?

If I had to guess, I'd say it's because they cannot prove to a third party that it meets all HIPAA (or insert your own group here) requirements.

Re: Dropbox passwords optional for four hours

#44

Post by gcr »

ern wrote: post #5

I hope they add login activity to their "Recent Events" feed ASAP.

How would that work? Dropbox doesn't require login most of the time; do you want them to log every time a computer viewed a file or just the web interface, which isn't the primary use interaction?

Re: Dropbox passwords optional for four hours

#45

Post by abofh »

kevin_morrill wrote: post #35
abofh wrote: post #24

Earlier quoted context omitted.

I didn't say they do, but they should hire people competent to make educated decisions in the regulatory environment they're in. That's why they pay bofhs -- not because they like our views, but because we _read_ the specs. EDIT: To phrase less hostilely -- HIPAA and various finance laws consist of thousands of pages of what to do and what not to do. Dropbox is a shiney webpage that isn't PCI certified or HIPAA certi…

HIPAA does not have thousands of pages on what and what not to do. It's actually quite vague, and mostly comes down to fines after the fact. There's also no such thing as a government sanctioned HIPAA certification. There's just random people willing to 'certify' you.

Quite right -- a better example is PCI compliance (hundreds of pages IIRC, and several volumes depending on exactly what you're doing; not a law, but similar ramifications if you don't comply);

Still, complying with HIPAA does make one point _very_ clear -- audit controls - Dropbox has none exposed to you, and thus it simply does not comply unless you have your own layer of controls (encryption) on top.

It also seems to fall down under 'Standard: Person or entity authentication' as well, but that's just me being snarky.

Health-care and finance are places with legal (or contractual) obligations -- and that was my main point: if you have a set of rules (or even best practices), and you fall afowl of them, don't go screaming that someone else is to blame.

Re: Dropbox passwords optional for four hours

#46

Post by wladimir »

gst wrote: post #26
VMG wrote: post #4

Earlier quoted context omitted.

The thing is that you can't do email then. You can say that google might leak your emails, but the same is true if you use your private email server.

The security of my private mailserver is nearly the same as the security of my laptop. For security reasons I don't use a VPS for email, but a small server that sits in my basement: There are some security measures that will lead to an automatic shutdown in case someone tries to physically access the server and the whole harddisk is encrypted. (Yes - you can call me paranoid.)

You go through a lot of trouble to try to secure an inherently insecure protocol (email). Or do you mainly use on-the-wire encrypted mail as well?

Re: Dropbox passwords optional for four hours

#47

Post by gst »

wladimir wrote: post #46
gst wrote: post #26

Earlier quoted context omitted.

The security of my private mailserver is nearly the same as the security of my laptop. For security reasons I don't use a VPS for email, but a small server that sits in my basement: There are some security measures that will lead to an automatic shutdown in case someone tries to physically access the server and the whole harddisk is encrypted. (Yes - you can call me paranoid.)

You go through a lot of trouble to try to secure an inherently insecure protocol (email). Or do you mainly use on-the-wire encrypted mail as well?

I don't care about things like (short-term) wiretapping. But I care about the fact that I have stored about 15 years of mail history.

Re: Dropbox passwords optional for four hours

#48

Post by icebraining »

gst wrote: post #25
ohyes wrote: post #3

I use any online service with the assumption that the things I put up there could likely become public, no longer anonymous, or what have you. I don't think this is overly paranoid, given how difficult computer security is. To me; it would make sense if Dropbox stored everything encrypted (as in, encrypted pre-transfer), and you needed the private key to decrypt stuff, unless you specifically state that it is to be p…

Depends on the online-service. E.g., I trust tarsnap (client-side encryption, not under an open-source license but you can compile it yourself) with very sensitive data. I also trust Wuala (also client-side encryption) with semi-sensitive data, although it somewhat worries me that Wuala's source is not publicly available for reviews. I don't trust Dropbox due to the lack of encryption - that's why I don't really use…

I just mount encfs over the Dropbox folder, it's perfectly transparent. It does need Fuse, so no Windows support, but I don't really need it.
Post reply on HN