Comment by kyledrake | Hacker News Reader

Comment by kyledrake | Hacker News Reader

This isn't surprising. Most service providers (including Facebook and Google) actively scan for known PhotoDNA hashes of CP provided by NCMEC and other groups, and will report if they detect and then verify any of them. I recall someone getting charged after using Gmail in a similar way. This isn't a legal mandate, they do this voluntarily.

This isn't "Dropbox employees digging through everybody's files hunting for CP". It's all automated, likely triggered by uploads of certain types of files (images/videos). They almost certainly have a human verify the validity before reporting (which is probably a 100% manual process). They're required by law to report it once they have reasonable suspicion.

An interesting abuse edge case here I've pondered for a while: someone hacks into your account and intentionally posts bad stuff to get you in trouble. It could be pretty difficult to prove that someone did this if the company's logs were inadequate. A similar flavor of this: someone sent Brian Krebs heroin in the mail, and then "tipped off" the police. Fortunately, it didn't work https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroi...

The kind of scary thing is that if someone else hacked into your account and posted bad stuff, even if you are later able to prove it wasn't you (alibi/IP address/etc), it may already be too late. Personal relationships will have severed. You will have lost your job. People may never look at you the same way.

Passwords are everywhere, and most people don't use MFA. If dozens of celebrities had their iCloud accounts hacked, there's no doubt that thousands of normal people could have their dropbox accounts hacked - for the purpose of adding nefarious files, not downloading sensitive ones.

> This isn't "Dropbox employees digging through everybody's files hunting for CP". It's all automated.

If a script can access users' data what's the difference?

Permissions?

How would Dropbox function if their scripts couldn't access user data?

For the storage functionality, they could encrypt/decrypt on the frontend, and store encrypted data only.

Someone else has pointed out that Dropbox has never promised end-to-end encryption of data, partly because it would be difficult to provide various user-friendly features. Also because it would be difficult on their end to apply the efficiency measures they have for doing diffs and file history.

Can't do de-duplication if you're encrypting. No way Dropbox's storage back-end remains viable without de-dupe.

Is that true though? I use Tarsnap and as I understand it, it does de-duplication server-side AND client-side encryption.

That said, the point probably still stands that encryption is probably not feasibly with Dropbox feature set (or while maintaining a certain performance).

Tarsnap deduplicates your data with respect to your data. It can't compare your data with everybody else's data, because your data is encrypted with keys which only you hold.

Dropbox deduplicates everybody's data, so that they'll be able to take advantage when you and someone else both store the same file. (Of course, this trivially means they can recognize when someone stores a file which the FBI has previously provided to them.)

Ah, of course! Thanks for clearing that up (I was hoping you would chime in).

Oh, and thanks for a product that does what I need it to do. I'd maybe have liked a bit more documentation (for example, how to speed up retrieving a backup), but other than that I'm very happy with it!

Attic/borg can do most (all?) of what Dropbox does without access to user data.

Barring client side encryption, Dropbox's servers are going to have your data.

I'm pretty sure if you asked a bunch of their customers (certainly corporate) they would find this very surprising.

I mean, I just went to their "about us" page and here is what it says:

We create products that are easy to use and are built on trust. When people put their files in Dropbox, they can trust they’re secure and their data is their own. Our users’ privacy has always been our first priority, and it always will be.

Wholesale scanning of user data with heuristics and automatic police reports out of no legal necessity whatsoever certainly doesn't spell "privacy always our first priority" to me.

serious question: who is tasked with collecting and classifying these awful photos?

NCMEC http://www.missingkids.com/home

Probably some others but that's the main US one. IIRC, they may be given special legal status here to this effect.

My Uncle had to do something similar for the NZ police. He had young children at the time, it was a distressing job for him.

I don't envy anyone that has to deal with child abuse at any level but I guess someone has to do it.

Reply on news.ycombinator.com