Hacker News Reader

Comment by lnrdgmz | Hacker News Reader

> On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no...

I've not forgotten, and this glitch has kept me from ever considering opening a Dropbox account.

I'm surprised everyone else seems so forgiving of this massive screw up.

View on HN

Haha for me it's the opposite. My password never works in Dropbox. I think it's because they don't support spaces in passwords, but they don't tell you when you change your password. They just accept the change and then you can't login.

There are many sites with little exceptions like that. I think that their password filter allows the characters, but their backend input sanitization doesn't, so it cleans it up and inserts a transformed version of the pass without providing notification. I've found this happens particularly often with passwords with symbols like !, #, or ;.

In general, this is one of the most frustrating things with trying to secure yourself online. I have gone through like "I WANT TO USE PASSPHRASES" then gone to places like PAYPAL and had them have an upper limit on password length. It's absurd that they all have slightly different requirements. I am switching to a password manager now.

This problem has been noted for some time. Past articles on the subject have shown how the various requirements for passwords come about through a combination of limitations imposed by the system they're being used on, or through misguided attempts at making things easier for users.

I wonder if there has ever been an attempt through a forum like RFCs or ISO to define a worldwide (or at least latin char set) standard for password requirements. Based on what i've seen in forums like this, there seems to be fairly broad acceptance that allowing a large number of characters from a character set with as few limitations as possible bests serves the interest of security. The thorniest issue would likely be about balancing requirements for increased complexity (eg capitals and lowercase, numbers, etc) with ease of use.

I'm using password with spaces for Dropbox without any problems. Must be something else is an issue at your side... Have you tried resetting it ?

Totally. You wanna talk about people forgetting? It seems everyone has totally forgotten (or forgiven) that Dropbox was mentioned specifically in the Snowden leaks as a source.

are there better alternatives though?

"Better" is subjective. I consider Google Drive much better, personally.

Alternatives, though? Plenty: Google Drive, Box, OneDrive, iCloud Backup and iCloud Drive.. the list goes on with a simple Google search for "online storage"

Does google drive work the same way as Dropbox? Cross platform, acts as a folder in your home dir, selective sync, etc? Seriously ready to move on from Dropbox and my google fiber account comes with a free terabyte of google drive.

I've never set it up but I believe that you can get it to work the same way.

Install the desktop application: https://support.google.com/drive/answer/2374987 Change sync settings: https://support.google.com/drive/answer/2375083

The Windows and Mac clients create a folder in your home directory. There are ways to rename it, but essentially anything you put in the ~/Google Drive/ folder is synced just like Dropbox.

No native linux support is a bummer, but if you only need to use it there infrequently, the web client is quite capable for manual uploads and downloads.

IIRC it has limited linux support, but works that way in windows/macOS. Another article today mentioned rclone, if you need linux support.

There's no Drive for Linux, alas.

Don't forget Spideroak! They offer end-to-end encryption of your data.

if you are willing to use a rather more complicated system with harder setup, syncthing.net is great, it syncs files between your computers without needing a cloud service.

For more similar alternatives, running owncloud on a VM is straightforward. And, of course the featureset is limited compared to Dropbox.

I had big problems with OwnCloud. Specifically it ate files at work, but did so in such an insidious manner (slowly, over time, with no indication that anything was wrong) that I don't trust it to this day. I haven't checked lately, but the issue was acknowledged by OwnCloud devs, with the workaround being to "use a secondary sync application" (no kidding). These days I use Seafile, and I can also say that your suggestion of Syncthing is a good one. I have used and enjoy both Syncthing and Seafile. Just a word of advice: Don't trust Seafile to encrypt your data. Use Veracrypt (or equivalent) in place of the built-in "encryption" offered by Seafile.

box.com is pretty good. I've personally used it for several years now and I can't recall the last time there was any real issue with it, usability or security-wise.

Reply on news.ycombinator.com