Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox opening my docs?

wncinfosec.com

Post reply on HN
Print view View original

91–100 of 136 posts

Re: Dropbox opening my docs?

#91

Post by tlogan »

tptacek wrote: post #23
madaxe wrote: post #11

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…

This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.

I wonder if you know which storage provider does not do this. As far as I each of these storage providers offer preview (including embeded images) thus they do need to open arbitrary links.

Re: Dropbox opening my docs?

#92

Post by CCs »

blcknight wrote: post #61
gboudrias wrote: post #50

Earlier quoted context omitted.

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.

TrueCrypt would work too - it has block level encryption and Drobox syncs on block level too.

Re: Dropbox opening my docs?

#94

Post by davidu »

yesbabyyes wrote: post #3

LibreOffice has a pretty powerful document conversion, which you can run headless. I'm guessing they are converting to HTML and perhaps other formats -- do they offer anything like that? Edit: You can invoke it something like this: soffice --headless --convert_to html file.doc I'm just speculating, but it seems reasonable that it would open the document just like the regular LibreOffice, fetch external resources and…

Dropbox used to use Crocodoc which was just acquired by Box... And now Dropbox doesn't use Crocodoc. And now we learn about LibreOffice...

Coincidence?

Just pointing it out...

Re: Dropbox opening my docs?

#95

Post by rexreed »

gboudrias wrote: post #54
rexreed wrote: post #51

Earlier quoted context omitted.

From what I understand, and again, I'm not with the company, it's not a cloud service, but rather downloadable / installable software that encrypts prior to storage on the disk.

Hmm, but then why do you need an account? And yeah, I see what you mean, but if you don't have access to the source, you don't know what they're making you install. I'm a huge FLOSS advocate, but in this specific instance it's more my paranoia talking. I believe I can trust them now, but how many clients will they need to have before the NSA blackmails them? It's still a step forward, somewhat, but I find it hard to…

The account is needed so you can grant authorization to others to access your files. EncFS is great if you are the only user. If you want to grant others access to your encrypted files, you need an authorization / authentication mechanism, which is why there's an account needed - for permission control.

But if you're the only user / potential accessor of the files, single-user strong file-system based encryption works.

Re: Dropbox opening my docs?

#96

Post by bigiain »

blcknight wrote: post #61
gboudrias wrote: post #50

Earlier quoted context omitted.

Am I reading this right? A third-party service that protects you from third-party services? And you have to install it everywhere? And it's not FLOSS? Please tell me I'm reading this wrong. Edit: Okay I see it's based on FLOSS and that's great, but as far as I can tell they're still asking you to install binary blobs, which makes the whole thing pointless.

Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.

This works, and works well.

I had a little trouble getting it to run on one of my older Mac OSX machines, but I'm pretty sure that was because I had the remains of a previous installation of MacFUSE messing things up -

There's also a MacOSX/iOS/Android/Windows commercial "wrapper" around EncFS which is fully compatible with the compiled-from-source versions of EncFS I've got running on Mac OSX and Linux (ARM and x86) - it's a "binary blob", but if your security/convenience tradeoff lets you consider that, have a look at BoxCryptor Classic:

https://www.boxcryptor.com/boxcryptor-classic

For me, the tradeoff of having secured/encrypted files available on iOS is worth the decrease in security by relying on Secomba GmbH not backdooring me at the request of the NSA or ASIO (my local security agency) – or anybody further down the security agency or law enforcement foodchain. I'm not actually trying to protect myself against targeted surveillance by any sufficiently powerful nation-state, but I feel good about knowing I'm not quite so readily caught up in "dragnet" surveillance…

Re: Dropbox opening my docs?

#97

Post by bigiain »

CCs wrote: post #92
blcknight wrote: post #61

Earlier quoted context omitted.

Install EncFS and use it on your Dropbox. No account, no binary blobs needed. You can compile all the bits for EncFS yourself, if you want.

TrueCrypt would work too - it has block level encryption and Drobox syncs on block level too.

Hmmm, I wonder if TrueCrypt adequately secures a hidden volume's existence from an attacker (Dropbox) who can watch the patterns of your block level writes?

Re: Dropbox opening my docs?

#98

Post by bigiain »

eli wrote: post #39
B-Con wrote: post #35

Earlier quoted context omitted.

I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.

I'm not a big fan of the content either. If you're going to imply Dropbox is doing something sneaky then I think you owe them the basic courtesy of a chance to comment or explain before you hit publish.

"Sneaky" or not – it's definitely unexpected behaviour. I certainly didn't expect .doc files I store in a Dropbox folder to magically go and fetch remote resources. Whether it's "explainable" or not (and I guess the "they're generating PDF thumbnails" is a plausible explanation), Dropbox haven't taken any steps to inform users that this happens.

There's little doubt that somebody will think up a way to take advantage of this to "leak" information.

I wonder if this happens before or after Dropbox's dedupe step? I wonder if that provides an avenue to extract useful data?

Re: Dropbox opening my docs?

#99

Post by fphhotchips »

badman_ting wrote: post #87
glitch003 wrote: post #76

Earlier quoted context omitted.

Why? Person embeds image in the doc or html file http://2.bp.blogspot.com/-iarq5sjWDWc/TWRxt8nPegI/AAAAAAAAA_... and then when the document is opened, Word (or LibreOffice in this case) tries to pull down the image to display it. Nothing fancy.

"Person puts some characters in the query string, and the web application reads it. Nothing fancy." I just described SQL injection.

SQL Injection isn't fancy. That's why it's such a bad vulnerability.

Re: Dropbox opening my docs?

#100

Post by abortz »

danielweber wrote: post #79
abstractbill wrote: post #48

Earlier quoted context omitted.

The machine isn't the only thing at risk. Given this setup, it seems possible to use dropbox nodes to ddos an external target, just by uploading lots of documents, each containing lots of these links. It doesn't seem like they should be fetching external resources at all.

There are lots of services that generate traffic on your behalf. A very general rule is that you should have to send at least as many bytes as the service does, lest you become a DDOS multiplier. I don't see a .doc file getting small enough to outsize a HTTP request inside of it, even if you used some funky compression, but I'm willing to hear otherwise. One question would be if you could upload the document once and…

Hi everyone, this is Andrew from Dropbox.

We do use LibreOffice to render previews of Office documents for viewing in a browser, and have permitted external resource loading to make those previews as accurate as possible. While this could theoretically be used for DDoS, we haven’t seen any such behavior. However, just to be extra cautious we’ve temporarily disabled external resource loading while we explore alternatives.

Post reply on HN