Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Is Probably Not Stealing Your Files

one.darrenpmeyer.com

Post reply on HN
Print view View original

61–70 of 105 posts

Re: Dropbox Is Probably Not Stealing Your Files

#61

Post by geographomics »

tptacek wrote: post #4

This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure". Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything l…

I couldn't be fussed to reverse it again, so instead used Rohitab Batra's excellent API Monitor [1] to figure out what's really going on.

Firstly to address files being accessed outside of Dropbox - this is true, but literally all it does is read the file attributes: https://i.imgur.com/TADvHp1.png. Moving up the call stack and disassembling the calling function, we can see that it's part of the Python runtime: https://i.imgur.com/1TBong4.png (presumably python27_lockdown.dll is Dropbox's custom hardened copy). A bit later on it does a comparison to ".bat", which identifies it as the function win32_stat() in Modules/posixmodule.c - the ensuing behaviour of this function corresponds to QueryBasicInformation as shown on the original author's Process Monitor dump. Why the Dropbox client calls stat() on files outside of the Dropbox folder (but on the same drive) is not clear, but, as the article above also mentions, that is all it does, so no problem there.

Secondly, the original author also posted evidence of Dropbox accessing various shell folders [2] - Desktop, Documents, Music, Pictures, and so on. This is true but again it's a side effect of an innocent function call, this time SHGetFolderPathW(): https://i.imgur.com/uXN31BI.png. It's actually SHELL32.DLL that is responsible for opening the folder and querying its attributes, not the Dropbox client: https://i.imgur.com/YCyTwNe.png.

Without reversing the entire program we can't say for sure that Dropbox isn't siphoning out data in some other sneakier way, but the accusations of data theft from these file events are simply not true.

[1] https://www.rohitab.com/apimonitor

[2] https://pbs.twimg.com/media/B_Kv4i3U8AEZLLt.png:large

Re: Dropbox Is Probably Not Stealing Your Files

#62

Post by ubernostrum »

chisleu wrote: post #39

Read their TOS and compare it to Google Drive's TOS. The insane rights the Google TOS grants to Google are why it costs ~ 1/2 as much. It is also an indicator that Dropbox is less shady. They don't grant themselves rights to do anything with your data outside of the normal things you need them to do to offer the dropbox service for your use. Unlike Google, which could for instance, use your personal photos of your ki…

I'm aware of nothing in Google's terms which isn't in the terms of every other user-generated-content service that has lawyers on staff.

In order to make copies (distributed storage, network traffic, etc.) and show copies to people -- including you, or anyone you choose to share a file or post with -- they basically have to have a license from you, or they're potentially on the wrong side of copyright law.

Re: Dropbox Is Probably Not Stealing Your Files

#63

Post by pyre »

radiospiel wrote: post #23
neohaven wrote: post #12

Earlier quoted context omitted.

Actually, it cannot for the shell extension for the checkboxes over synced files. It needs to look at every file seen with Explorer to do that.

Really? The shell extension could just ask the dropbox daemon if something is known about file x/y/z, and the daemon would answer "no" if the file is outside its folder. No need to look into the file for that. Or did I miss something?

If you look at the analysis posted elsewhere, Dropbox only queries the long-name of the file since apparently Explorer can still send it a short-name version of the file (e.g. "C:\PROGRA~2" instead of "C:\Program Files").

Re: Dropbox Is Probably Not Stealing Your Files

#64

Post by tux3 »

tptacek wrote: post #4

This is a fine post, but all I can think about this situation is "or, you could just reverse the Dropbox client and find out for sure". Speculation about Dropbox stealing files seems premised on the idea that you can't know what the client is doing. But that's not even close to true. People reverse much, much harder targets than Dropbox for fun. If any version of Dropbox published to its user base ever did anything l…

Those were my exact thoughts.

Even without having to go open IDA, I'm sure windows has enough system monitoring tools that you should be able to tell what Dropbox actually reads outside of its own data, if anything.

Re: Dropbox Is Probably Not Stealing Your Files

#65

Post by MrDosu »

About every form of backup software will use change journals to identify what to backup and how it changed.

Change journals are streams that are per volume (so to monitor some directory in C:\ i have to monitor the C:\ change stream).

It's just how NTFS works. It's shocking that this was allowed to reach this kind of publicity because it's just a guy attaching a diagnostic tool to a system where he doesn't know whats happening and then proceeds to freak.

Software like this will have plenty of file access for metadata, not only on the backed up files.

Re: Dropbox Is Probably Not Stealing Your Files

#66

Post by TheLoneWolfling »

MrDosu wrote: post #65

About every form of backup software will use change journals to identify what to backup and how it changed. Change journals are streams that are per volume (so to monitor some directory in C:\ i have to monitor the C:\ change stream). It's just how NTFS works. It's shocking that this was allowed to reach this kind of publicity because it's just a guy attaching a diagnostic tool to a system where he doesn't know whats…

And this is where having the API actually support, say, monitoring only items in a single directory would be good.

Re: Dropbox Is Probably Not Stealing Your Files

#67

Post by MrDosu »

TheLoneWolfling wrote: post #66
MrDosu wrote: post #65

About every form of backup software will use change journals to identify what to backup and how it changed. Change journals are streams that are per volume (so to monitor some directory in C:\ i have to monitor the C:\ change stream). It's just how NTFS works. It's shocking that this was allowed to reach this kind of publicity because it's just a guy attaching a diagnostic tool to a system where he doesn't know whats…

And this is where having the API actually support, say, monitoring only items in a single directory would be good.

Well there is, but it's unreliable in certain edge cases. At least not reliable enough for a backup solution.

Re: Dropbox Is Probably Not Stealing Your Files

#68

Post by MrDosu »

radiospiel wrote: post #46
sigil wrote: post #45

Earlier quoted context omitted.

Well, dropbox could just listen for fs events inside the DropBox folder... On Linux at least [1], this is exactly what the Dropbox client does. It only registers inotify watchers on the $HOME/Dropbox directory and subdirectories. To verify: strace -f -e trace=inotify_add_watch dropboxd You could also strace open/stat/read/write syscalls to verify that, aside from shared libraries and the like, the Dropbox Linux clien…

> Other OSes have different file monitoring capabilities though. Anyone up on file monitoring on Windows / OS X? Is directory-specific monitoring possible? yes

But ReadDirectoryChangesW notoriously misses updates. Also it would scale horribly to large amounts of files.

NTFS has a feature called Change Journals where you can view a volume as a stream of changes.

Re: Dropbox Is Probably Not Stealing Your Files

#69

Post by shawnhermans »

chisleu wrote: post #39

Read their TOS and compare it to Google Drive's TOS. The insane rights the Google TOS grants to Google are why it costs ~ 1/2 as much. It is also an indicator that Dropbox is less shady. They don't grant themselves rights to do anything with your data outside of the normal things you need them to do to offer the dropbox service for your use. Unlike Google, which could for instance, use your personal photos of your ki…

You claim that Google could use personal photos of my kid eating ice cream to sell advertising? This seems directly against their terms of service found at http://www.google.com/policies/terms/.

> Some of our Services allow you to upload, submit, store, send or receive content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

Do you have any proof of this ever happening? Do you have any legal case that support your claim? Can you please point to the text in their TOS that leads you to believe this?

Re: Dropbox Is Probably Not Stealing Your Files

#70

Post by sarciszewski »

x1798DE wrote: post #55
yc1010 wrote: post #14

Earlier quoted context omitted.

Not really, one could get a unique enough hash by reading the first lets say 10,000 bytes of each file, and it would be faster than hashing the whole file edit: here i was bored enough > http://pastebin.com/NJEvnG1d

I wrote something that was hashing audiobook files that was taking forever, so I tried using the first N bytes (likely much more than 10kB), but soon found that for any given audiobook, each chapter's MP3 had a large identical header on the front end - I imagine that it was a cover image embedded in the metadata. I think in the end I just started taking the data from the end of the file, but if you're going with subs…

Maybe:

    File > 12 KB: First 4 KB, last 4 KB, middle 4 KB
    File
Post reply on HN