Hacker News Reader

Comment by flipp3r | Hacker News Reader

I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.

View on HN

FYI - they do certificate pinning for their clients and won't let you proxy the HTTPS connections, last I checked.

I'm not saying this as cause for alarm. Obviously if they were sending the files you could measure the volume of traffic if nothing else.

Make a completely random non-compressible file that's of an arbitrarily significant size (say 1M+) and see if that amount of traffic goes out to them.

I do think Dropbox is watching for filesystem events outside of the locations users specify, but I see zero evidence they're uploading information about the files / the files themselves so far.

Maybe

  sed -i 's/old certificate/new certificate/g' /usr/bin/dropbox

Used to work in some software.

EDIT: Matasano has a nice guide for bypassing OpenSSL cert pinning (for iOS apps, but the techniques should be more broadly applicable): http://chargen.matasano.com/chargen/2015/1/6/bypassing-opens...

One can hack Windows HTTPS libs (or OpenSSL, whatever it is) inside Dropbox process and read unencrypted buffers from memory. Standard and well-documented APIs are easy to locate and hook, especially in dynamic libraries.

If anyone has a lenovo box, they could use its Superfish feature to get around this.

Superfish doesn't get around pinned certificates.

Plus, anyone can create a root certificate and install it in their own trust store. You don't need Superfish.

I think kweinber was kidding, though.

Reply on news.ycombinator.com