Can Dropbox Be Trusted?
My co-worker was reviewing Dropbox as an option for our company's file backup, sharing, and syncing and he came across this language in their privacy policy:
Business Transfers. Dropbox may sell, transfer
or otherwise share some or all of its assets,
including your Personal Information, in connection
with a merger, acquisition, reorganization or
sale of assets or in the event of bankruptcy.
Perhaps this is a question for a lawyer (maybe we have one reading HN...), but doesn't this give Dropbox too much freedom with my data? Would you still use their service with this policy in place? Am I overreacting??
33 comments
[ 6.7 ms ] story [ 112 ms ] threadThe second paragraph defines Personal Information to be information that personally identifies you, like your name and contact info.
That explains his weight gain. But what about this privacy issue?
I think though that if you're going to be storing say, customer CC info, you don't want to be using a service like dropbox regardless of their policies. I don't think they are the right choice - you should be handling the security of this information yourself, or use clauses like dropbox's yourself to remove liability.
As a business, this would be the more worrying clause though:
We may employ third party companies and individuals to facilitate our service, to provide the service on our behalf, to perform Site-related services (including but not limited to data storage, maintenance services, database management, web analytics, payment processing, and improvement of the Site’s features) or to assist us in analyzing how our Site and service are used. These third parties have access to your Personal Information only for purposes of performing these tasks on our behalf.
Why? Because lord knows where the heck your information is, and if some admin from a company three steps removed gets his laptop stolen, it could come back to haunt you.
Good point considering ValuesOfN (Stikkit & I want Sandy) and Pownce are shutting down leaving the users to gather up their data and find somewhere else to play. Contingency of service is something I'd be thinking about.
http://blog.infowranglers.com/blog/_archives/2008/9/16/38803...
I'm NOT a security or legal expert, but my concerns would be more about the security of sensitive data, rather than concerns over the possible sale of personal information (it's been a while, but I don't remember Dropbox asking anything too intrusive.)
You cannot specify your own AES key, which might be a worry to some people. The DropBox team suggest sharing encrypted disk images if this is an issue.
I think that this highlights a general problem with web-based services. How do you trust them to safeguard your data? Its hard enough when the software is local on your own computer and you have contact with some immediate physical retailer but with the web, who knows?
Oh well... Its the old security vs. convenience problem again.
To do that, and to distribute that data from a single point means that someone other than you have a key to read those data. You will have to protect your data by encryption yourself before uploading.
Perhaps you should evaluate Tarsnap from http://www.tarsnap.com/ which is in public beta as of this writing. It provides a neat backup service and has a publically readable/accessible description of what measures that are taken to protect your data from adversaries. I have not tried it myself, but I happen to know that Colin Percival knows what he is doing.
Thanks for the vote of confidence. :-)
And as noted, Personal Information is the stuff you give them at registration.
Furthermore, please don't put extremely sensitive data somewhere on the cloud with little to no protection. Common sense.
As for encrypting data before it's uploaded. Sure, I mean if you believe their target demographic is tech-savy enough. Which probably means a small fraction of their current users.
I think security in the cloud has to be a shared a responsibility between users and providers, for all cloud apps. Telling your users that it's their sole responsibility is ridiculous and not very competitive... unless you're releasing an open source offering to sysadmins. Technology has gotten so confusing for the typical end user that of course they're not going to invest the time to understand what cloud security even is, whether or not you believe they should.
Next question!
That's not to say Dropbox would do that. But it probably would be nice to explicitly say somewhere that you won't sell or give away the physical bits that are uploaded to the service.
pasted from terms:
Dropbox does not claim any ownership rights in Your Files. You acknowledge that Dropbox does not have any obligation to monitor the Files or User Posts that are uploaded, posted, submitted, linked to or otherwise transmitted using the Site or Services, for any purpose and, as a result, is not responsible for the accuracy, completeness, appropriateness, legality or applicability of the Files or anything said, depicted or written by users in their User Posts, including without limitation, any information obtained by using the Site or Services. Dropbox does not endorse anything contained in the Files or User Posts or any opinion, recommendation or advice expressed therein and you agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against Dropbox with respect thereto.
Do you need to claim ownership of something in order to "share" it with a third party? (strictly legally speaking, of course)
The rest of the paragraph is just covering of your back. This is fine, of course, just not relevant to the point.
You never know when that nosy Arash might decide to load up your Quicken file :)
On the other hand, I use Dropbox to synchronize non-sensitive files between my machines. I never put anything on there that I'd be worried about being published unprotected to the world.
If I were to store bits that need encryption on a service like this I would encrypt them before I hand them off.
The web client is a bit more of a problem, they would just have to promise to encrypt it right away.
Since encfs is transparent and stores its results as plain old files, Dropbox only has to sync individual updates.