Hacker News Reader

Comment by pentae | Hacker News Reader

I suppose when you're not able to give an unwavering commitment to protecting your customers data, coming up with a completely unrelated corporate social responsibility plan like this makes sense.

View on HN

This. It's amazing how many big companies use Dropbox with how limited their commitment to protecting customer data has been.

I suspect that corporations have much more leverage in this than consumers...

For US corps maybe, but many foreign companies also use dropbox even though they have little to no leverage in the US.

Clarification needed. When you say their commitment has been limited, do you mean they have done things that go contrary to protecting data (like selling user data to ad companies, or handing user data to government agencies when requested) or that they haven't actively taken a stance for protecting customer data (such as duckduckgo's promise not to track you, or Wikipedia's promise to stay donation-based).

What exactly are you referring to? My life is stored on Dropbox so I'd rather like to know.

Dropbox doesn’t encrypt your data. There area bunch of other companies that do encrypted cloud storage, eg keybase

Yes it does, see https://www.dropbox.com/security

Decryption keys are stored on Dropbox's servers, which makes this encryption pointless if the company turns evil.

Not all decryption needs to be end to end encryption. I’m not sure when this idea developed, but it’s silly.

If your threat model mandates that you use end to end encryption, go for it, and choose something other than Dropbox. But saying the encryption is pointless just because the organization that manages the keys could become “evil” is hyperbole.

Dropbox deduplicates files across user accounts to minimize storage. Effectively, this means all accounts share one private key for encryption...

Edit: to be clear, I believe it is an option on enterprise accounts to use your own key.

This shouldn’t be downvoted. The page states clearly that data is encrypted both in transit and at rest.

I want web access to my files in Dropbox, so E2E encryption is not an option. Ok, you could do decryption in the browser, but I wouldn't trust that.

37signals, not Dropbox: Trust is Fragile | https://news.ycombinator.com/item?id=3470876 (2012)

>foreverbanned: They didn't mentioned the filename at first. What they actually said was: "And a Basecamp user uploaded the 100,000,000th file (It was a picture of a cat!)"

AFAIK there is no equivalent Dropbox incident, though they were forced to clarify their marketing in 2011: https://en.wikipedia.org/wiki/Criticism_of_Dropbox#May_2011_...

In which way is Dropbox data not protected? Do you mean they tend to lose files?

Dropbox doesn't encrypt your data. Compare them [1] and SpiderOak [2] for example.

[1] https://www.dropbox.com/security

[2] https://spideroak.com/no-knowledge/

Yes Dropbox encrypts your data. It even says so on the Dropbox page you linked to :-)

But encrypted in a way where Dropbox employees still have unencrypted access to your files, at least according to Christopher Soghoian back in 2011:

https://www.theregister.co.uk/2011/05/16/dropbox_ftc_not_goo...

That’s a different claim and one with severe tradeoffs for the other option: you can regain access to your Dropbox after losing your password.

Since you’re running their software, you’re ultimately trusting their policies anyway. Even if they had encryption at rest it wouldn’t tell you that it’s correctly implemented and doesn’t e.g. leak keys.

They do - but they hold all keys themselves.

They encrypt in transit, but not data at rest by the looks of things. At least I don't get that impression.

Per your link, Dropbox states only metadata isn't encrypted. "The actual contents of users’ files are stored in encrypted blocks with this service. Each individual encrypted file block is retrieved based on its hash value, and an additional layer of encryption is provided for all file blocks at rest using a strong cipher."

Reply on news.ycombinator.com