Dropbox exposes personal details of viewers of publicly shared Paper documents

I had a chance to join a machine learning team at Dropbox a few years ago. Ultimately what made me decline was this feeling that everyone in the office was sort of a zombie on autopilot. Nobody was excited about anything, all the use cases being kicked around for machine learning were extremely contrived recommendation and automation features that seemed like they had no real product research or stakeholder support to pursue them.

It was like everyone was just resigned to raking in money on top of an extremely boring storage platform and clearly nobody was going to risk generous salary or equity coming in so they could rock the boat with an ambitious project.

All to say it doesn’t surprise me that there was some lapse of quality checking or oversight on some feature of Paper integrating with Dropbox.

The whole place reminded me of this quote by TS Eliot, “Oxford is very pretty, but I don’t like to be dead.”

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#5

Post by buboard » Thu, Sep 26, 2019, 12:28 PM UTC

"seems problematic" - understatement of the month

I always thought those indicators about who is viewing a publicly shared document were creepy

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#6

Post by daniel_iversen » Thu, Sep 26, 2019, 12:28 PM UTC

gdhbcc wrote: post #3

This looks like a GDPR breach. Does anyone know where i can find the details for the dropbox GDPR representative?

Why is it a GDPR breach when a Dropbox screen clearly explains to the user clicking the link that other users will see your details if you proceed? (Just curious, it may well be an issue, I just don’t know how).

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#7

Post by marksomnian » Thu, Sep 26, 2019, 12:30 PM UTC

WilliamEdward wrote: post #2

DropBox doubled down. https://twitter.com/DropboxSupport/status/117695661143435264... https://twitter.com/DropboxSupport/status/117695664129355777... https://twitter.com/DropboxSupport/status/117695667110665830... (And they have no idea how twitter threads work)

It's probably their CS Twitter client that's coded without proper awareness of threads (likely only letting staff reply to the original message)

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#8

Post by gizmo » Thu, Sep 26, 2019, 12:31 PM UTC

This is completely reckless, but I'm not surprised. This is the company that pushed an update that allowed people to log on to any account with any password. Clearly they haven't learned anything about good security practices or responsible data governance.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#9

Post by feketegy » Thu, Sep 26, 2019, 12:38 PM UTC

It's 2019 and devs still can't get this st right.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#10

Post by neogodless » Thu, Sep 26, 2019, 12:46 PM UTC

"For teams to work across the internet, they need to be able to see who else views the document on their team."

"Got it, agreed."

"What if they make it public, and the team is anyone on the internet?"

"Same! Name, email, maybe more?!"

No. No! If something is shared publicly, who views it should not be public knowledge. Or it should be screamed in blaring, blinking, marquee high-contrast banner across the screen to everyone before viewing the document.