Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Is Probably Not Stealing Your Files

one.darrenpmeyer.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Dropbox Is Probably Not Stealing Your Files

#81

Post by saalweachter »

geographomics wrote: post #41
sarciszewski wrote: post #17

Earlier quoted context omitted.

I would be very surprised if a workplace name like Dropbox has never been reverse engineered by a bored hacker on a lazy weekend. Surprised and disappointed.

I reversed it back when it was version 1.1.something, it was basically all compiled Python modules with custom encrypted code objects and non-standard opcode mappings for the bytecode. Quite interesting to see how it worked, and useful to get the key for the encrypted logs, to see it what it actually did while running. Back then you could intercept the https connections as well as they hadn't pinned the certificates…

So what you're saying is that, if I wanted to launch a nefarious file-stealing Dropbox-like application, I should first launch the non-nefarious version, and then when it gets up to 3.6 or so, turn evil?

Re: Dropbox Is Probably Not Stealing Your Files

#82

Post by jamiesonbecker »

ProAm wrote: post #31
whizzkid wrote: post #19

" 1 - Create a large-ish file (1MB) outside of the Dropbox folder 2 - Monitor the network usage of the Dropbox application to see if it sends enough data that it could be that file " I can not really say if Dropbox steals them or not. But if i were a Dropbox engineer and want to know about those newly created files, i wouldn't want to send the whole file to server at all. - Send file name with its extension - Send fi…

And they don't have to steal the whole file at once, why not chunk it out and do bits at a time over a few days. This is tinfoil hat territory, but they'd still get the file and network traffic wouldnt be overly suspicious.

You don't need to retrieve the file if you already have it.

Re: Dropbox Is Probably Not Stealing Your Files

#83

Post by shdon »

shdon wrote: post #57
eli wrote: post #54

Earlier quoted context omitted.

I think you're misunderstanding the TOS. I do not think Google is subsidizing their storage costs by abusing your private photos.

They might not be doing it (and probably aren't), but they do have the right.

Interesting how I'm getting downvoted for stating this. The language does come awfully close to explicitly stating just the thing:

"We collect information to provide better services to all of our users – from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful"

even explained thus:

"For example, if you frequently visit websites and blogs about gardening, you may see ads related to gardening as you browse the web."

and they say that they base it on:

"Information we get from your use of our services."

Again, not explicitly named, but not forbidden either by their own privacy policy.

Re: Dropbox Is Probably Not Stealing Your Files

#84

Post by jamiesonbecker »

Dylan16807 wrote: post #58
copsarebastards wrote: post #28

The cycle of security is this: 1. Security experts see a security hole and note that it could only be used by a widely trusted company or government. 2. People note that it's also possible that it's not happening, and claim that the widely trusted company or government would never use the security hole. 3. It is discovered that the widely trusted company or government has been using the security hole.

"Touches files it doesn't have to" is not a security hole.

Perhaps it's semantics, but you're right - it's not a security hole.

It's worse.

Exceeding authorization is exploiting an existing hole.

Re: Dropbox Is Probably Not Stealing Your Files

#86

Post by Dylan16807 »

copsarebastards wrote: post #60
Dylan16807 wrote: post #58

Earlier quoted context omitted.

"Touches files it doesn't have to" is not a security hole.

"Users install program that touches files the users might not want it to" is a security hole. The unknown is whether Dropbox comes with malware which takes advantage of that security hole.

A hidden function or update could enable malicious behavior on all files whether or not it had preexisting behavior of touching all files. Only in certain detailed permission structures would preexisting behavior matter.

Re: Dropbox Is Probably Not Stealing Your Files

#87

Post by sliverstorm »

chisleu wrote: post #78
shawnhermans wrote: post #69

Earlier quoted context omitted.

You claim that Google could use personal photos of my kid eating ice cream to sell advertising? This seems directly against their terms of service found at http://www.google.com/policies/terms/ . > Some of our Services allow you to upload, submit, store, send or receive content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours. Do you ha…

You need to actually read the TOS for dropbox. It says they can use your stuff for any service they offer now or in the future. I don't need proof. You need to go read the TOS I mentioned already.

I think you may need to re-read the comments you yourself wrote and replied to.

Re: Dropbox Is Probably Not Stealing Your Files

#90

Post by r00fus »

chinathrow wrote: post #29

"This is, by necessity, a system-wide process." This is, by design, a fucking huge defect of the underlying system calls. Give the OS a list of folders to watch. Dropbox should not even get a callback for a file it's not is supposed to watch.

Exactly - how much information can be inferred from the file and path alone - in a lot of my cases (for very personal files), quite a lot.

If Dropbox gets to interpose itself in every file update systemwide, that sounds like it's getting too much of my information. Encrypted/Stego drives don't matter - once you open it up to the system, Dropbox sees when you touch it.

All I can gather from this discussion is that I'm glad I'm not using Windows and Dropbox together.

Post reply on HN