91–100 of 105 posts
Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…
Yes, it's possible they named her to their board in good faith, and it's possible they also resisted the NSA somehow, where Google and Microsoft and Yahoo and countless others failed. But, do you consider it likely enough to bet your privacy on it? It seems to me you would be foolish to do so.
The only other excuse for it I can think of is that it's so obviously corrupt that it proves they aren't corrupt after all - that no one could be that stupid. I reject such meta-reasoning. They are simply corrupt.
Earlier quoted context omitted.
You need to actually read the TOS for dropbox. It says they can use your stuff for any service they offer now or in the future. I don't need proof. You need to go read the TOS I mentioned already.
I think you may need to re-read the comments you yourself wrote and replied to.
Earlier quoted context omitted.
You need to actually read the TOS for dropbox. It says they can use your stuff for any service they offer now or in the future. I don't need proof. You need to go read the TOS I mentioned already.
I think you may need to re-read the comments you yourself wrote and replied to.
"When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content . The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). "
They changed the TOS to rephrase, but didn't remove the infringing portion. It used to say any service offered now or in the future, and now it says "to make new services."
The fact is, my original statement stands.
They can quite literally use your content for any reason because they can use it to develop new services (such as, say, personalized road side advertising.)
There is nothing legally stopping them from doing it, and if you have been paying attention to the issues highlighted by Snowden and others, there is little backlash to them as a company for doing very evil things such as leaving inter-datacenter communication unencrypted allowing the NSA and others to snoop upon Gmail and all other google services as the data replicates across locations.
Good times talking to you. Appreciate the down votes.
Once again, make sure you actually read the damned thing in question before even replying to a comment about it. You ignorant, uninformed points are worthless.
Also, here is the dropbox TOS: " Your Stuff is yours. These Terms don't give us any rights to Your Stuff except for the limited rights that enable us to offer the Services.
We need your permission to do things like hosting Your Stuff, backing it up, and sharing it when you ask us to. Our Services also provide you with features like photo thumbnails, document previews, email organization, easy sorting, editing, sharing and searching. These and other features may require our systems to access, store and scan Your Stuff."
REMARKABLY less ambiguous, and in fact enumerates the Services they offer. They literally only want to host your data. Google wants to data mine your data, even if you delete the data and your google account, google wants to keep using your data, forever.
This isn't the same thing.
Pure speculation follows. I wonder if they could be calculating hashes of files and sending them off? That would be useful for automated exfiltration and targeting. For example: 1. Calculate the SHA-256 hashes for files in places of interest. 2. Report the hashes upstream. 3. Hey, this file matches one that the FBI/NSA is looking for via NSL. 4. Download more stuff. Also identify the person and their location. 5. Sen…
Wouldn't they need to have the file already if they know its hash?
Earlier quoted context omitted.
I reversed it back when it was version 1.1.something, it was basically all compiled Python modules with custom encrypted code objects and non-standard opcode mappings for the bytecode. Quite interesting to see how it worked, and useful to get the key for the encrypted logs, to see it what it actually did while running. Back then you could intercept the https connections as well as they hadn't pinned the certificates…
So what you're saying is that, if I wanted to launch a nefarious file-stealing Dropbox-like application, I should first launch the non-nefarious version, and then when it gets up to 3.6 or so, turn evil?
Well, dropbox could just listen for fs events inside the DropBox folder; and it should, from a performance perspective as well as from a privacy point of view. And then "sends a few 100 kByte"? I hope this is a typo; if not, I would like to know what these are. (also: the OP's largish file (1MB) could easily fit into "a few 100kByte" after compression)
Well, dropbox could just listen for fs events inside the DropBox folder... On Linux at least [1], this is exactly what the Dropbox client does. It only registers inotify watchers on the $HOME/Dropbox directory and subdirectories. To verify: strace -f -e trace=inotify_add_watch dropboxd You could also strace open/stat/read/write syscalls to verify that, aside from shared libraries and the like, the Dropbox Linux clien…
Earlier quoted context omitted.
I think you're misunderstanding the TOS. I do not think Google is subsidizing their storage costs by abusing your private photos.
I think you aren't actually reading it. I do not think Dropbox is less good at running storage than Google or Amazon, yet Google is 1/2 the cost.
This is why Dropbox (smartly) does not want to compete on price -- instead they want to compete on quality. There's no way to be cheaper than Google, Microsoft, Apple and Amazon in the long run, because they each have other businesses that are licenses to print money. If one or more of them decide to heavily subsidize their online storage product, they can outlast you.
However, it turns out that all of the money in the world can't magically make a great product. You still have to actually do the hard work.
Earlier quoted context omitted.
"Users install program that touches files the users might not want it to" is a security hole. The unknown is whether Dropbox comes with malware which takes advantage of that security hole.
A hidden function or update could enable malicious behavior on all files whether or not it had preexisting behavior of touching all files. Only in certain detailed permission structures would preexisting behavior matter.
Are you seriously arguing that it's okay for Dropbox to touch files you didn't give it permission to touch? This is ridiculous.