Something I found interesting from the comments on that article was the claim that Dropbox remotely deletes mp3 files that infringe copyright.
Can anyone else confirm that they do this? It's surprising to hear that--I would have expected that if something's in your private Dropbox, there couldn't be any copyright infringement at all. Aren't backups generally considered fair use?
I think watermarking - inserting a few nearly-inaudible bits in a song/whatever to identify the owner - is becoming more and more common. To name just one example.
Dropbox will react to DMCA notices and "will take whatever action, in its sole discretion, it deems appropriate, including removal of the challenged content from the Site."
which would mean that the session info is also going over the clear, which means that you don't need to dump the files or info, you can use their own client to do that along with a forged session token
A great feature of OSX is the Apple Disk Image. [1] It lets you have a single file, with AES-256 encryption, that can be mounted and then used as a disk (put files on it, create folders etc). Perfect for keeping anything sensitive in Dropbox, such as passwords, statements from your bank etc etc. Even if your account gets compromised and the file gets copied, your data is safe.
The article mentions TrueCrypt, which is a better option for people who are using multiple platforms. However, neither TrueCrypt nor Apple Disk Image are appropriate for people who need to access their Dropbox files from their Android phone, which is what the article discusses.
That's true. I wasn't responding directly to the article, but just wanted to share a convenient solution to the problem of "I want my private stuff synced, but I don't want to trust Dropbox or anyone else with it".
The response on this is pathetic. Dropbox was made aware that some people have a valid objection to metadata being plaintext three months ago and now they only take it seriously when it shows up on HN?
As a paid DropBox and Android user I'm second guessing use of the product.
Here is a pro-tip: If your way to get "Speed" involves being "Insecure" than someone needs to get wacked aside the head with the hardest nerf bat you can find. Repeatedly. While screaming "NO NO NO THAT'S STUPID".
Dropbox's website was vulnerable to passive session hijacking until they took note of Firesheep and fixed it.
Both this and the mobile issues would have been identified on the first day of a security audit by even someone with little experience. Dropbox has continued to demonstrate that they do not take security seriously, which is confusing and unacceptable considering the entire company is built on the idea that people will trust them with their data.
Dropbox's claim that the lack of SSL is a speed issue sounds like total nonsense. I'll again reference Adam Langley's work at Google:
"In January this year (2010), Gmail switched to using HTTPS for everything by default. [...] In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead."
23 comments
[ 4.9 ms ] story [ 56.2 ms ] thread> Holy crap, the iPhone version is worse! I just fired up my proxy and found it's transmitting both the metadata and the files via HTTP.
Could anyone confirm? This would be a pretty serious flaw.
http://forums.dropbox.com/topic.php?id=24507
Can anyone else confirm that they do this? It's surprising to hear that--I would have expected that if something's in your private Dropbox, there couldn't be any copyright infringement at all. Aren't backups generally considered fair use?
That said, yes, I'd expect them to stay out of my data unless I do something silly like using them as a distribution mechanism.
Obviously, but how can Dropbox tell if the files are torrented or were purchased legally without DRM? Or legally ripped from a CD for a backup?
That said, I don't think Dropbox should care.
http://www.dropbox.com/terms#dmca
As they will probably never receive a DMCA notice for your private folders they won't delete anything. (My opinion, I'm not associated with Dropbox)
edit: replaced provide with private
1. http://en.wikipedia.org/wiki/Apple_Disk_Image
As a paid DropBox and Android user I'm second guessing use of the product.
Here is a pro-tip: If your way to get "Speed" involves being "Insecure" than someone needs to get wacked aside the head with the hardest nerf bat you can find. Repeatedly. While screaming "NO NO NO THAT'S STUPID".
https://www.dropbox.com/votebox/4452/enhanced-mobile-client-...
How can I trust that Dropbox cares about the safety of my data when they make such amateur security mistakes in their mobile app?
Both this and the mobile issues would have been identified on the first day of a security audit by even someone with little experience. Dropbox has continued to demonstrate that they do not take security seriously, which is confusing and unacceptable considering the entire company is built on the idea that people will trust them with their data.
Dropbox's claim that the lack of SSL is a speed issue sounds like total nonsense. I'll again reference Adam Langley's work at Google:
"In January this year (2010), Gmail switched to using HTTPS for everything by default. [...] In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead."
http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht...