Dropbox for Business | Hacker News Reader

Dropbox for Business

dropbox.com

67 pointscharlieirish58 comments

Couple of reasons why this might be news.

1. Under /features check out the 'Certification and Compliance section'.

>> Dropbox's storage is SSAE16/SOC1, SOC2, ISAE 3402 and ISO 27001 certified on Amazon S3 and may provide data mirroring across other secure data centers

SSAE16/SOC1 compliances were not present in the earlier versions and this is a decent step forward for adoption of dropbox in larg(ish) IT departments. This will imply "firewalls are in place at all externally facing access points".

2. From a usability point of view, the promise of a seamless way to integrate both your personal and work accounts from the same device.

3. "Seamlessly upgrade existing Dropbox accounts to Dropbox for Business and transfer files to a co-worker when someone leaves", although this is in Beta currently, this reduces a lot of headache for IT departments during employee exits.

Seems like most of the other features remain the same, though.

I suspect they're just piggy-backing on Amazon's certifications. Notice how they say "Dropbox storage", not the entire service.

> 2. From a usability point of view, the promise of a seamless way to integrate both your personal and work accounts from the same device. [emphasis mine]

It wasn't clear from the announcement that Dropbox for Business will support multiple work accounts on the same device. The marketing content appeared to be written to appeal for enterprise IT managers, who obviously wouldn't be worried about this.

For IT-managed devices that's fine, but there sure are a lot of people nowadays with side businesses or who consult with multiple organizations that all want to share files. And currently it's easier to use Box (or Google Docs) than sharing folders via Dropbox and worrying about busting each sharee's Personal storage quotas.[1]

[1] https://www.dropbox.com/help/59/en

Until they implement client side encryption I cannot use this service. Forget about NSA, what about rogue admins, or just plain bugs.

Dropbox = Your-Unencrypted-Files-Here.com

Client side encryption defeats the purpose of most of the value-add features of Dropbox.

I'd actually argue that it would make the service more dangerous, as once you decrypt a file outside of the context of your desktop, the Dropbox service has the key. How do you share a file on the web or via mobile client with low friction without rendering that client-side encryption useless? (A: You don't.)

IMO, if you have data security needs that necessitate client-side encryption, and you use a public service to store that information, you need to give up whiz-bang features or reduce your security requirement.

> How do you share a file on the web or via mobile client with low friction without rendering that client-side encryption useless? (A: You don't.)

Exactly. Not all of us _need_ to share files, I just need a secure backup. And it is technically possible to access files on various clients using only client-side encryption and separate encrypted files from plain-text should you need to.

From a compliance standpoint, these are pretty meaningless. Sounds like Dropbox marketing isn't taking security and compliance very seriously.

Actually, it really bothers me that Dropbox touts these things as compliance factors (vs. features of the underlying storage system). Dropbox is the user-facing service, not Amazon S3.

If I put a bunch of money in some super-duper safe, chain it to a flatbed truck, and then leave the truck unlocked with the engine running, the safe doesn't make that money secure.

You can't make any assumption based on SSAE16/SOC1 compliance, without looking at the statement of applicable controls.

You can take more comfort from the ISO 27001 compliance

The only reason we still use Dropbox rather than Box is that Dropbox is ubiquitous.

For us this means one thing: There is a well-supported and maintained Linux client that just works.

I've no doubt we'll be giving Dropbox for Business a try, but it's pretty much because of the ubiquity rather than anything else.

we tried box and dropbox and went with dropbox as it supports LAN-Sync (tremendously helpful when you are shoving around Photoshop files) which box didn't at the time and the Linux client.

On the same topic, we thought about btsync as well. But ubiquity won out, there's a lot of convenience in being in a meeting and being able to check your phone and pulling up the latest copy of a document.

box lets you pull up a file on your phone... we find the versioning and collaboration features of box to be far supperior to dropbox... lan sync is nice though, I didn't actually know dropbox had that.

In addition to these, the inability of box to handle mac bundle type files was a show stopper.

I just installed Box to take advantage of the free 50gb. The one critical thing I think Box is missing over Dropbox is being able to take advantage of sym links. Until then, Box is a boy among men.

Well, this would have been great to have before making me convert my personal account, i.e. with my non-work email address, to an account managed by my employer.

My entire office is in the same boat, so I tried to figure out whether it’ll be possible to convert back to a personal account before being re-added to a business account (of the new kind), but I couldn’t find anything.

Do you know for a fact that this won’t be possible?

It's possible with intervention from Dropbox staff. When I first set up the business version, I didn't quite understand what was going to happen (and it is all very non-intuitive, I found) and long story short I basically lost my personal account. I freaked out but support restored it and I used another email address for my business account. Then I used dropbox portable to juggle two dropboxes on one machine, but that was a pain in the ass, so I just used some computers for personal and others for business.

Why would you do this, though? It's your personal account. When I had to connect to a business account, I set up a second account.

The problem is that we all use Dropbox to share files around the office. So if someone is at home, they still need access, and you can only be signed in with one account at a time. The other benefit is that we get a HUGE amount of storage under a business account.

All in all, the whole process needs some revision on their part.

You can run 2 dropbox instances at the same time, both hooked into a different account.

This isn't the same way I did it, but here is an article on it.

http://lifehacker.com/5971204/run-multiple-dropbox-accounts-...

Host your valuable business secrets with easy NSA access.

Same here, since the Snowden revelations we have absolutely no interest in storing ANYTHING in the US.

Dropbox is a great Tool, no question, but if you're a company (outside of the US) you should think about what you store where.

I'm fine with Dropbox, but there's my Boss, you know.

A good alternative outside the US is http://www.jottacloud.com/. Servers in Norway.

This probably puts you at even greater risk, since the intelligence folks don't even have the pretense of rule of law once you're outside the borders. That, and the Nordic countries have traditionally been very friendly to U.S. req^H^H^Hdemands for information.

Easier (legally) for NSA folk or other bad actors to hack yes. But when did that stop them?

But if your data never crosses a US border (E.g. a Norwegian person using jottacloud), then the NSA cable taps have no effect. If your server is not in a US server farm or in a US Company, then it can't be subverted at destination the way that lavabit was going to go (and the other major companies have already gone).

I'm really suspicious of this "safer in the USA" stuff right now.

> "if your data never crosses a US border (E.g. a Norwegian person using jottacloud), then the NSA cable taps have no effect"

Perhaps, as pertains to the taps we were warned about by Mark Klein, Snowden, et al. But if you think that's the full extent of US intelligence taps, Angela Merkel's cell phone rather disagrees. (And the notion that they'd tap a half dozen foreign leaders before they tapped a trunk line or five is pretty laughable.)

I somehow doubt the NSA is going to be constrained because it doesn't cross a border. With the NSA's money and engineering resources, I don't really think any data is safe anywhere.

> I somehow doubt the NSA is going to be constrained because it doesn't cross a border.

That taps at borders which NSA / GCHQ have legal access to are well documented: http://www.independent.co.uk/news/uk/politics/operation-temp...

Other borders ... not so much.

> With the NSA's money and engineering resources, I don't really think any data is safe anywhere.

The NSA are legally constrained. They can't walk into a data center in Germany waving a court order and insist on a tap and no publicity. This is essentially what happened to lavabit because their data center was in the US. Yeah, a data center in Europe could be hacked. but:

1) Any bad actor could try to do this

2) Trying to do this in a notionally friendly country is not the most diplomatic thing. Not saying it can't happen but it would be arrogant and risky. Consider the fallout if some disgruntled sysadmin drops dox on it. http://www.cbc.ca/news/world/nsa-s-alleged-spying-on-merkel-...

It shouldn't matter where you're hosting, if you want privacy it needs to be encrypted by you. The NSA can still get its hands on data outside of the US, but regardless of where something is stored you can lock it up fairly easily.

You could always use Boxcryptor (https://www.boxcryptor.com/)

It's easier for them to access when it's stored outside of the United States... you get that, right?

There are laws in the US that they attempt to abide by that make this more difficult domestically, but not as difficult on foreign soil.

Laws without a publicly reviewable adversarial judicial process are kinda like backups without verification, right? Its probably better than nothing, but you don't know the difference until something goes wrong.

One of the features is "All the space you need. Start with 1,000 GB and get more space as your team grows. If you run out, tell us and we'll increase it for free."

I wonder if that means one could sign up for 5 accounts and pay $75/month for unlimited space for personal use. (You could just use one account and never sync the other four.)

Yes, this works. You don't even need to sign up for 5 accounts - just get one business one and never add any additional users to it.

Or use Crashplan for $5 a month (paying yearly) and store a TB anyways ;)

CrashPlan is a backup / archiving app. Its use case is very different than Dropbox.

Anyone else having their office ISP connection totally destroyed by 100+ Dropbox clients attempting Monday morning sync? We have a balanced, 300Mbs connection for about 160 users, and our network becomes unreliable during 5 minute bursts throughout the day.

I thought Dropbox implemented some type of local lan sync?

Not sure why this is news - they've had this for months. I signed up for the business plan the instant it was available several months ago.

It's about the new features, which make quite a difference (being able to use both business and personal from one account).

Maybe I'm missing some information, but how can that not be sponsored by the NSA? Will foreign companies still trust such a service? It's still excellent service, though, but I'm wondering how it will become a good deal for clients.

Google Drive is cheaper, and you can collaborate way easier than dropbox unfortunately. I love dropbox but I can't see myself switching if Google is offering the same thing for a better price.

I guess it is inevtiable for Dropbox to keep offering 5Gb for free accounts for much longer. (Are they even doing that?)

Free accounts are 2GB, however you can do a couple of tasks to get more.

With few tricks I went to 18GB.

Could you elaborate?

https://www.dropbox.com/help/200/en

You get space when linking your Dropbox with Twitter, and things like referring friends. If you participate in the yearly challenges, you get space for every step you complete successfully.

I won't speak for the parent, but, some people have been know to use Virtual Machine that pretend to be a "Friend" and take advantage of Dropbox's customer acquisition technique.

This works. They use your MAC address of your network adapter to differentiate referrals.

No they don't; I've referred multiple times from the same machine using different users.

In mid 2013 I signed up 22 referred accounts in a VM box for a family member with a newly created Dropbox account. Three months later all 22 inactive accounts were removed, and the extra storage was gone too.

I did it in 2011 as well for my own account and still have the extra storage. I've since upgraded though. Even 15GB is peanuts today...

I used a $100 Google Adwords coupon to advertise Dropbox on Google with my referral link. I did it to proof it could be done, not that I needed the extra space. Many others have done the same in the past http://www.lifehacker.com.au/2011/11/max-out-your-dropbox-re...

I do not know if it is still the case, but if you used the "Camera Upload" feature in the past you could get extra space at 500 MB for each 500 MB uploaded up to a certain capped amount. When the feature was in beta it was capped at 5GB extra, but before it went stable they lowered the cap to 3GB.

It'd be great if you could have dropbox for business but be able to deploy it and maintain it on your own servers.

Why is this at the top of HN?

Because people voted for it, use the service, and are interested in discussing it. You can see the discussion this brought forward in this very page.

Now, why was your comment even made again?

Dropbox is a ycombinator-funded company

Reply on news.ycombinator.com