Dropbox Password Goof Let Any Password Work For 4 Hours

tekgoblin writes "Dropbox confirmed today that for some time yesterday, any user's account was accessible without a password. The glitch was a programming error related to a code update and accounts were only vulnerable from around 1:54 pm PST to 5:46pm PST." "Only" is relative; as reader zonky puts it, "It took around 4 hours from deployment for Dropbox to notice they'd entirely broken their authentication scheme."

Comments

Regression testing

[Bogtha]

This is why automated regression testing is a best practice. I guess Dropbox don't test their authentication.

Re:Regression testing

[buchner.johannes]

This is why automated regression testing is a best practice. I guess Dropbox don't test their authentication.

That would be so oldschool. We do agile development now, and the user is the tester once the unit-tests pass.

</sarcasm>

Re:Regression testing

[Richard_at_work]

No, they have never claimed that the password was involved in the encryption they use - they use one single encryption key for all data stored. Their terms of service did say that your data is inaccessible without your password, but this is nothing more than permissions rather than per-account encryption.

There has been lots of valid shit thrown around about Dropbox over the recent weeks, but please do try and get stuff right before you complain.

Re:Regression testing

[Nikker]

This is Slashdot, the start tag was posted in 1999.

Re:Regression testing

[Lieutenant_Dan]

Their terms of service did say that your data is inaccessible without your password, but this is nothing more than permissions rather than per-account encryption.

Or it could be that a personal encryption key is stored in their user profile database. So all data is still uniquely encrypted per user, but access to the key is available to the admins (and as you indicated limited by process/permissions).

I would hope that every person's data is not encrypted with the same key. If that's the case, then they may as well close shop now.

Re:Regression testing

[Richard_at_work]

Again, no - its been well documented that Dropbox does global deduplication and single instance storage, across all data in their database. That would not work anywhere near as well for them if each account used its own encryption key - until they turned it off recently due to abuse, you could shove an Ubuntu iso into your local Dropbox and have it "synced" 100% in seconds, as the Dropbox servers realise that they already have it in their global pool, and simply tell your client not to upload it.

So yes, they use a single key.

Re:Regression testing

[gstoddart]

Well, gee, that makes me feel good about their security...

I've never treated Dropbox like it's secure. It's convenient for copying around files, but I wouldn't use it for anything sensitive.

I think if you're aware of the fact that it's only *slightly* more secure than a public folder on a shared network and use it accordingly, you can still make use of Dropbox as a tool. Although, admittedly, my usage of it has diminished since I initially got it.

Re:Regression testing

[Eivind]

It should be possible to do global deduplication while still using encryption. You'd need to store (unencrypted) hashes of the files stored though.

What you typically do is encrypt a block with a random session-key, then you encrypt the key with the users public key, and store both. (the encrypted block, and the encrypted session-key), the legitimate user then retrieves the encrypted session-key, decrypts it with his private key and uses that to decrypt the encrypted block.

With this scheme, there's nothing stopping you from storing the session-key encrypted with *both* (or more than 2) private-keys.

This is the same thing GPG and friends do if you specify 2 or more recipients for the same message. They encrypt the actual message only once, with a one-time random key. Then they encrypt that *key* once for each recipient. This saves space 'cos the key is typically much smaller than the message.

You'd need the hashes unencrypted though, to be able to tell that two people have the same files -- even if you don't know what's in those files. And this does, offcourse, leak *some* of their privacy. (one could, for example answer the question: does person X have file Y, yes or no ?)

Re:Regression testing

[h4rr4r]

The processing power is not the issue, the storage is. They can't do global dedupe on the block level if they use per user encryption.

How about testing?

[mcvos]

Doesn't a service like that have a preview deployment where they can properly test it? Maybe some automated testing for their authentication system, which I believe is a pretty big part of what they're doing?

Alas, testing is much like security, in that many companies try to get away with as little as possible.

Re:How about testing?

[Chris Mattern]

Automated authentication testing that doesn't test using the wrong password?? Must have been brought to you by people who took the short bus to Q/A training...

Fire the programmers please

[james_van]

Seriously, someone needs to have their head roll. Proper authentication is a.) the first thing I learned when doing web programming b.) reasonably simple to put in place c.) so damned important that even for a small website with nothing particularly sensitive, anyone who drops the ball on it should shown the door with swiftness. I really like Dropbox, but they've had some drama lately and I think it's time to look elsewhere

Re:Fire the programmers please

[Lieutenant_Dan]

Chances are they enabled a function to impersonate any users in order to validate that it was working properly without having to know someone's pwd. Problem obviously is that they kept the original config. Deployment team, testers or devs probably share the problem equally. Most likely someone forgot to document all the steps including re-enabling the authentication piece.

Relax, it was only 4 hours.

[Combatso]

Relax honey, I only left our baby alone in the bathtub for four hours.
Relax Mr. President, We only let our enemy control our nuclear arsenal for four hours
Relax Japan, we have enough battery backup for the cooling system for four hours
Relax Gulf Residents, it's only been spilling oil for four hours
Relax Public, the serial killer has only been escaped for four hours
Relax Columbine Parents, the killing spree and stand off only lasted for four hours

Re:Relax, it was only 4 hours.

[SJHillman]

Relax Mr. Sys Admin, the hacker has only been downloading your database for four hours.
Relax Mr. Homeowner, your house has only been burning for four hours.
Relax Facebook users, your information has only been sold off for four hours... errr... years.
Relax Mr. Necrophiliac, she's only been dead for four hours.

Re:Relax, it was only 4 hours.

[xtracto]

but fortunately there is no evidence of any unauthorized access.

Of course not, all the access where authorized by the faulty authorization system.

Dropbox's followup is no good

[Wuhao]

Not only was there a serious security issue here, but Dropbox customers are having to find out about this through blogs. Dropbox has yet to email its users about this issue. It claims on its blog that users who logged in during this time have been notified. I logged in during this time, and have received no notice.

I am now leaving Dropbox. I need to review Wuala and Spideroak to see if they meet my needs, but I can safely say that this event and Dropbox's earlier behavior has demonstrated to me that they do not take the security and privacy of their customers seriously.

The Most Interesting Developer In The World

[Kozz]

I don't test my code. But when I do, I do it in Production,

Re:Let me summarize every comment that will appear

[h4rr4r]

If I'm trusting my private data to a company to store

Then we can safely dismiss your comments as the ravings of a fool.

If you want to see what all these companies think of your private data, look at their SLAs. Do they offer anything more than subscription fee back in case of leak or loss?

Data exposure isn't the only consequence.

[EvilSpudBoy]

A lot of people are saying you shouldn't keep anything sensitive in the cloud but having your personal data exposed isn't the only problem here. Dropbox automatically synchronizes to your PC so during this period anyone could have pushed any file out to your PC without your knowledge --maybe substitute an EXE with a virus, or replace your family photos with child porn.

wrong kind of thinking

[rubycodez]

bugs will happen, all the time. The problem here is that there are processes missing, management has failed. Your ideas of software development need to change, it is not a one-man-band.

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

wooohaaaaaa

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

gv dsgasdgsadg

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

slowdown cowboy

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

xcv xbdf g agsdgsdah

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

how many more?

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

come on there are more?

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

fdshg hdfhsdf

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

vbc xvbndfgr reyher trhfssd

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

Itsuka kitto anata no yume ga kanau made
Mitsumeteitai zutto

Fensu koshi itsudemo kaze ni yureru sebangou
Dare yori mo anata no koe ga hibiiteru
Natsu no hizashi no naka hi ni yaketa yokogao
Genki ni waratteru anata wo mitsumeteta

Dare mo inai gurando hitori anata no
Yume wo kanjiteita no

Ganbare yume ni mukatte hashiritsuzukeru
Anata dake ni eeru wo okuritai itsudemo
Gooru ha tooi keredo kujikenai de
Mada minu hi ni deau made

Anata no yunihoomu yuuhi ni akaku somaru
Ashita mo aeru noni naze ka sabishikute
Muchuu de oikakeru massuguna hitomi ni
Deatta ano hi kara anata ni koi wo shita

Ganbare yume ni mukatte hashiritsuzukeru
Anata dake ni eeru wo okuritai itsudemo
Gooru ha tooi keredo kujikenai de
Mada minu hi ni deau made

Subete ga umaku ikanai tsurai toki demo
Sono mama no anata de ite kawaranai de
Anata ni koishite hajimete mitsukerareta
Yuuki wo ima todokeru kara

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

cxv fte wrtgrea trweyg ehu rtujrtuj

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

98reu t3489utg43j pgyerh p8hyqeryh

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

vcbc htyhrtsh

Re:sad day for interwebz freedom fighterz

[Dainsanefh]

bvnv nvvc rfsg bhehy54eyh