No, I'm not trying to compete against hotdoge posting horror news ;)
Nevertheless, here is another privacy threat which grabbed this old paranoiac's attention:
Dropbox Lied to Users About Data Security, Complaint to FTC Alleges
How Dropbox sacrifices user privacy for cost savings
And the updated answer in the Dropbox Blog:
Privacy, Security & Your Dropbox (Updated)
Just another reminder, that there is nothing like privacy in the net.
graylox
Robert
StrayCat
Thanks Graylox.. some mighty interesting and educating stuff to read.
Still ,I'm quite happy with the Dropbox facilities... even with the new TOS and its 'file deduplication'.
Looks more like a craze trying to discredit Dropbox.
Anyway:
about government data requests...
Just so you know, we don’t get very many of those requests — about one a month over the past year for our more than 25 million users. That’s fewer than one in a million accounts.
I think most people can live with that.What do we have to hide anyway... :)
Then again I'm not talking companies and data mining by non authorized personnel.
Well, "the authorities" are not the biggest threat in our part of the world (at least that's what I hope) but that's different in other countries.
What I understood from these articles is the fact, that others as well could have access to the users' data, because the employees could decipher the passwords.
I have read elsewhere, that most security breaches are not caused by hackers but by employees.
graylox
Anonymous
Unregistered
Data held in Dropbox was and still us vulnerable to inspection by U.S. authorities.
You shouldn’t use Dropbox if you have something to hide.
Dropbox, one of the favourite cloud synchronisation services available for free, ‘deceived’ its users about the security and encryption of its cloud storage services.
http://www.theregister.co.uk/2011/05/16/dropbox_ftc_not_good_enough/
"Dropbox's customers face an increased risk of data breach and identity theft because their data is not encrypted according to industry best practices,"
Anonymous
Unregistered
http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/
Under Windows, Dropbox stores configuration data, file/directory listings, hashes, etc in a number of SQLite database files located in %APPDATA%\Dropbox. We’re going to focus on the primary database relating to the client configuration: config.db. Opening config.db with your favorite SQLite DB tool will show you that there is only one table contained in the database (config) with a number of rows, which the Dropbox client references to get its settings. I’m going to focus on the following rows of interest:
email: this is the account holder’s email address. Surprisingly, this does not appear to be used as part of the authentication process and can be changed to any value (formatted like an email address) without any ill-effects.
dropbox_path: defines where the root of Dropbox’s synchronized folder is on the system that the client is running on.
host_id: assigned to the system after initial authentication is performed, post-install. Does not appear to change over time.
After some testing (modification of data within the config table, etc) it became clear that the Dropbox client uses only the host_id to authenticate. Here’s the problem: the config.db file is completely portable and is *not* tied to the system in any way. This means that if you gain access to a person’s config.db file (or just the host_id), you gain complete access to the person’s Dropbox
Robert
StrayCat
The Dropbox story continued...
Just found this interesting article in my mailbox, written by Woody Leonhard on the Windows Secrets webpage:
Re-examining Dropbox and its alternatives
Some excerpts:
You may find those(TOS) terms chilling, but Dropbox does make a compelling argument in its favor by comparing its Privacy Policy with those of Apple, Google, Skype, and Twitter. Apple and Google store data online and have similarly broad-reaching policies. Skype and Twitter aren’t quite so broad, fitting the nature of their service.
Depending on your level of security comfort (or paranoia), you have four possible choices if you want to synchronize data in the cloud:You can use Dropbox, realizing that the staff of Dropbox has the capability to read your data and send it to duly constituted authorities in some jurisdiction or another. If you understand the situation and it doesn’t bother you, more power to ya!
You can encrypt your data before Dropbox gets it. The people at Dropbox recommend TrueCrypt, which runs on Windows, Mac OS X, and Linux. In general, all you have to do is put a TrueCrypt-encrypted file inside your Dropbox folder and change one setting on the TrueCrypt file. Dropbox has a forum thread that describes the approach and some of its problems. Suffice it to say that most people find it works easily. The major downside? It doesn’t work on mobile devices, and file uploads and downloads might take longer.
You can use one of the integrated Dropbox third-party routines that perform encryption and decryption. At this moment, SecretSync and BoxCryptor are the best-known representatives of the genre. Both work with the Dropbox API and allow you to encrypt and decrypt the data with your own keys. Dropbox still encrypts the files (a second time), but should the occasion ever arise where Dropbox or some nefarious person uses the Dropbox key, the resulting file will still be scrambled — and you’re the only one with the key.
Please do read the full story on windowssecrets.com.(and maybe vote for it)
So...YEAH ,still sticking with my Dropbox...with and without secondary encryption :)
Anonymous
Unregistered
http://www.h-online.com/security/news/item/Dropbox-left-login-door-open-for-4-hours-1264195.html
Dropbox left login door open for 4 hours
Dropbox has admitted that an erroneous code update on Sunday 19 June allowed logins without authentication and allowed users to access files held by other users of the file synchronisation service. This occurred at 9:54PM UK time and the error went undetected for just under four hours until Dropbox discovered it (at 1:41AM); a fix was deployed in five minutes and all logged in sessions were dropped.
You must log in to post.
