Hacker News Reader

Comment by emmett | Hacker News Reader

1) What about this issue would have been helped by client-side encryption? A valid username and password was used to access dropbox information, so it would have gone right through client-side encryption.

2) Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.

View on HN

> Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.

You can have web interface with client-side encryption. Check aes.io (plug).

> What about this issue would have been helped by client-side encryption

I was assuming that an employee account can in a more or less direct way access user files. Either way, it's not the first time they've been compromised and last time[1] client-side encryption would have certainly helped.

> Do you not enjoy features like the web interface and public links?

The web interface could work with client side encryption. I wouldn't mind having no encryption for publicly shared files.

[1] www.wired.com/threatlevel/2011/06/dropbox/

You assumed wrongly. They accessed an employees account and took a file out, they didn't further compromise Dropbox's backend in any way. So in this particular instance, client side encryption wouldn't have helped at all.

Reply on news.ycombinator.com