Hacker News Reader

Comment by lgeek | Hacker News Reader

Maybe they should offer client side encryption. You know, the kind that's not reversible on their side of things.

1) What about this issue would have been helped by client-side encryption? A valid username and password was used to access dropbox information, so it would have gone right through client-side encryption.

2) Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.

> Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.

You can have web interface with client-side encryption. Check aes.io (plug).

> What about this issue would have been helped by client-side encryption

I was assuming that an employee account can in a more or less direct way access user files. Either way, it's not the first time they've been compromised and last time[1] client-side encryption would have certainly helped.

> Do you not enjoy features like the web interface and public links?

The web interface could work with client side encryption. I wouldn't mind having no encryption for publicly shared files.

[1] www.wired.com/threatlevel/2011/06/dropbox/

You assumed wrongly. They accessed an employees account and took a file out, they didn't further compromise Dropbox's backend in any way. So in this particular instance, client side encryption wouldn't have helped at all.

Client side encryption would stop Dropbox from deduplicating the data. Very few people rip their own CDs. Instead they buy them from a digital store or pirate them. In either case the mp3 will not be unique. If you look in the average users home directory you'll find a few megabytes of word documents, a few hundred megabytes of family photos and maybe their music collection.

If we assume that the set of files users sync is similar to the set of files in their home directory then it is not a stretch to conclude that Dropbox deals with lots of music. Dropbox cannot do anything about the documents or family photos but they can save considerable bandwidth and disk space by deduplicating the music, or any other common media.

Since dropbox's biggest input cost is storage I could well see client side encryption having a consider effect on their profitability.

You could construct a de-duplicated system with client side encryption by building an index pre-encryption. There is some leakage of information about what files exist, but not the contents of those files, and IMO the "files which are shared widely among Dropbox accounts" are NOT the ones people care most about keeping encrypted...

There are several systems with client side encryption, some of which also have de-duplication, and at least one of which has interesting crypto (bitcasa).

This is all unrelated to the authentication problem with dropbox today, though.

Due to exaggerated copyright concerns, Dropbox no longer dedupes across customers, last I checked. People were using dedupe to "instantly send" files (a project called Dropship). Dropbox felt that made them too liable for copyright infringement and nixed the feature.

Reply on news.ycombinator.com