Hacker News Reader

Comment by tptacek | Hacker News Reader

A system can easily be set up to lie about its MAC address, and you can't hide the legitimate MAC address. It's a very bad secret value.

The only thing you can do, without entering the reverse engineering arms race, is to add a real second-factor key to the equation --- meaning, something a user has to remember or read off a fob. And in fact, only the fob helps you here, since malware can (and does, every day, in bank fraud trojans) capture any secret you enter.

I agree that it would be better for security if Dropbox made rekeying happen more, but they can do the cost-benefit better than I can here.

View on HN

Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate.

When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt.

Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.

This works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.

Banks absolutely do this once they have the ability to talk to the OS. I've built 3 banking apps for iphone/ipad now and client side verification was involved in all of them after first login.

The problem is browsers just don't have a good standard way of accomplishing this.

All my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)

I think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.

Blizzard freaks out about changing IP addresses when you sign in to World of Warcraft. I have two internet connections at home and sometimes I switch back and forth, and back when I was playing WoW, it would lock me out after each switch. I had to login to my account via the battle.net website and stell it that everything was ok.

It was extremely annoying. The last few times it happened I just didn't play for a while because I didn't want to bother with reauthenticating; that's when I realized that I didn't enjoy the game that much any more and cancelled my account.

for the sake of counter-example: facebook does. E.g. if you try to log in from a different country than ones it already knows you have to go through a long process of reauthentication by inputting your friends' names based on pictures. At least, it happened to me twice.

Again, the machine ID is easily faked by an attacker.

Yes, systems can definitely fake any ID you attempt to use: MAC addresses, machine IDs, hostnames, etc. Attackers can intercept rekey attempts and clone the new key on their systems. But arguing that these improvements shouldn't be done because they don't totally close every security vulnerability in a system is an example of Perfect Solution fallacy [1]. Just because security cannot be perfect doesn't mean that steps to improve it shouldn't be taken.

The advantage of rekeying or secondary verification of the client is that it addresses the kind of attack where you can simply copy this metadata and have enough information to remotely compromise the Dropbox data later. As you say, whether that is worth fixing is up to Dropbox to do a cost-benefit analysis. But I hope they wouldn't discard the chance to improve their security simply because a perfectly secure system isn't possible.

[1] http://en.wikipedia.org/wiki/Nirvana_fallacy#Perfect_Solutio...

> The only thing you can do [...]

Or you could build a trusted end point. Otherwise even two factor auth is only palliative. (But yes: cost-benefit, I hear you).

http://www.businesscomputingworld.co.uk/two-factor-authentic...

In addition to MAC address use adding no real security it would get in the way of running Dropbox on a flash drive, which works even if not ideally.

Keep in mind here "not ideally" includes "you lose your flashdrive, then whoever finds it has full and ongoing access to your Dropbox account".

That's kind of a worry.

Ongoing? I can still use the website to delete the host whose host ID is on the flash drive.

So long as you realised... From FTA:

"Taking the config.db file, copying it onto another system (you may need to modify the dropbox_path, to a valid path), and then starting the Dropbox client immediately joins that system into the synchronization group without notifying the authorized user, prompting for credentials, or even getting added to the list of linked devices within your Dropbox account (even though the new system has a completely different name) – this appears to be by design."

Of course I assume that I eventually notice the theft of a USB stick on which I put enough information for Dropbox to sync my entire tree. Does the article say that I can't revoke a machine's access via the web interface once the config.db for that machine has been copied?

Reply on news.ycombinator.com