Hacker News Reader

Comment by stupidcar | Hacker News Reader

I feel bad for users who have to deal with supposedly-security minded companies who cite weak, historical reasons for not doing the right thing now.

Companies who ignore the actual solutions proposed to them, and instead attack a straw-man. Claiming they're being asked to make backwards incompatible changes for all existing users, instead of providing an an opt-in alternative for users who actually care about their security.

Companies whose culture is so inept that they blindly commit the most basic of engineering fallacies: Rejecting solutions on the basis of minor flaws, while defending a incumbent solution with massive flaws, simply because it is incumbent.

View on HN

Are users' Dropbox creds (password, optional 2FA) in 1Password?

Do you see AgileBits' point about that?

If your own creds are able to use more than the app folder, and if your threat is Agile Bits binary, the 1P app folder permissions will do nothing, the evil binary will just use your full creds.

Sounds like clamoring for them to reduce a bunch of use cases in service of security theater.

AgileBits is doing the wrong thing here.

Dropbox full access is stored on their servers and it's in clear text. Dropbox regular login/password is also stored on their servers, but encrypted via a remote master key.

If AgileBits is compromised, they can access all your DropBox files. Attackers still can't access regular login/password because of the lack of master keys.

How is Dropbox access stored on AgileBit servers? I buy an app license. I then set up a vault in a Dropbox folder just like a local folder. I use 1Password to access that vault. Same goes for the iOS app. If the worry is iOS, one should assume that every iOS app company that uses Dropbox has a copy of your Dropbox creds on their server, correct?

It is my understanding that at no point, does AgileBits store my Dropbox creds. It also does not store my 1Password vault.

Almost everything you just said is incorrect.

You don't even enter your dropbox password into the app unless you're storing it as a credential, they present an authentication dialogue for the dropbox API just like all other third-party apps accessing Dropbox and store the OAuth key on the client. Not the server. That's why you have to re-authenticate with dropbox on every device you want to set up 1Password sync.

I stand corrected. There is no security - or security added - issue.

Okay, but this still makes device able to access my entire Dropbox, which is insane!

One person's "thing that is broken for weak, historical reasons" is another's "pebble on the inevitable mountain of technical debt."

Complexity scales super-linearly on number of features. Solutions aren't the hard part. Implementations are.

The users don't have to deal with it. No one forces you to use 1Password. They've been asked and stated their position and don't owe anyone anything else. If the folks in the thread (or here for that matter) don't like the answers, don't use the product. Pretty simple.

Are we allowed to say why we don't like what they are doing?

Are we allowed to tell other people why?

Then what is the problem??

Sure, complain away! This is the Internet after all. My problem is the fake pity for users who make the conscious choice to use the problem despite - or regardless of - it's faults. If you don't like how AgileBits handles Dropbox permissions, either don't give it Dropbox permission or don't use 1Password. Complain, sure, but don't pity users for the sake of hyperbole. I read the original post in this thread as genuine pity for AgileBits, which I share - they get to make the application they choose, and users may or may not use it. But hyperbolic pity for the users? That's my problem.

Without users your product is nothing regardless of how great your product is. You are nothing without your users. You are what you are because of your users. Many companies forget that Agilebit is one of them. Throwing your users under the bus just because you can is not acceptable.

As someone done Dropbox integration for many of my clients, I know how easy it is to implement app folders.

I know it and you know it. We all know what kind of game agilebit is playing here.

I've never implemented Dropbox in an app, so I don't know. But what you don't know is that the people who message AgileBits on their website are even customers in the first place. And even if they are, which I'll concede because I don't care, there were a handful of them. Presumably this is a handful out of thousands? Millions? If it mattered to more people, more people would complain. That was my point.

They addressed the ease of implementation, and have a valid point - it breaks backwards compatibility. That is something I do know about, and it's a terrible thing to do. Yes, they could write a migration path. Yes, they could write all the documentation in the world to go with the migration path. But, yes, it will cause their existing customers - who aren't complaining, save a handful - pain, since the app will stop working as expected, even if only briefly. And that still doesn't address the fact that AgileBits gets to make the app they want to make, and we have the choice to use it or not.

The ease of implementation was never their rationale not to, and even was acknowledged in the thread. And my primary point was that they're only accountable to users as far as they can keep them, and have the freedom to make the application they want.

Its very convenient for them to use backward compatibility as an excuse. but in reality its simply not true. they can implement the change totally transparent to the user. have seen people do crazy things with dropbox integration in on 2 day hackathan's. in this case of moving the storage to app folder, shouldn't take more than coupe of weeks for an junior engineer. only things is whether you are willing to do it nor not. Apparently agile bits are not willing to do. (who would't like to access entire dropbox folder of the users ;) )

Keep in mind that, since dropbox did not have app folder concept initially, many companies used to have access to entire dropbox then moved to app folder model later. they did not break backward compatibility and they didn't make the excuses.

Reply on news.ycombinator.com