Slashdot Mirror
Dropbox Head Responds To Snowden Claims About Privacy
First time accepted submitter Carly Page writes When asked for its response to Edward Snowden's claims that "Dropbox is hostile to privacy", Dropbox told The INQUIRER that users concerned about privacy should add their own encryption. The firm warned however that if users do, not all of the service's features will work. Head of Product at Dropbox for Business Ilya Fushman says: "We have data encrypted on our servers. We think of encryption beyond that as a users choice. If you look at our third-party developer ecosystem you'll find many client-side encryption apps....It's hard to do things like rich document rendering if they're client-side encrypted. Search is also difficult, we can't index the content of files. Finally, we need users to understand that if they use client-side encryption and lose the password, we can't then help them recover those files."
Search is also difficult, we can't index the content of files.
umm duh, that's the point? sucks when your customers can't trust you.
With the keys we readily hand over when warranted.... o_O
Dropbox has Condoleeza Rice on its board of directors. If anyone remembers, she was Secretary of State and also the president's National Security Advisor during the Bush administration. She basically allowed torture, and is responsible for Guantanamo. She had no problem with torturing people without even doing a basic check to see if the person being tortured was guilty of the crime he was being tortured for. And you want to talk about spying? She was part of the administration that developed the PATRIOT Act. The justification being "it's ok to spy on foreigners" .. Oh and we can DECLARE you a foreigner without any due process by making you prove your Americanness. She was cool with torturing foreigners without giving them any sort of due process, so why would you assume that she wont torture citizens if she was scared into doing so? We already know she doesn't think people need privacy.
It's not stupid; it's just a fact. Obviously they can't do any of that crap if they can't decrypt your data, but that's fine by me.
It's not stupid; it's just a fact. Obviously they can't do any of that crap if they can't decrypt your data, but that's fine by me.
Exactly. Gotta love the knee-jerk, I can't have a logical thought because I'm just so ready to rant about "the man" bullshit. Especially since it sounds like it's coming from someone who doesn't even use or understand the service.
Dropbox is file storage, plain and simple. I use it to make a few music files and some reading material available across my devices. That's it's main function, to store/share files.
All that other shit he is talking about that encryption won't work with is all fluff and ancillary stuff - I name my files properly, for example, so I don't need them to search within them for me. The service works just fine with encrypted files - you just can't use the fancy doodads that you don't really need anyway.
I applaud him for being honest - if this was certain other companies they'd be telling you "oh trust us. It's secure!" He's being honest - it's a dumping spot for files, if you want encryption, BYO.
Christ some of the folks around these parts don't know their heads from their asses - use the words encryption or privacy and they don't even listen or understand wtf is being talked about they just automatically jump to tired fear mongering rhetoric. Just like the folks who take rifles strapped across their backs to Starbucks - I want to say, WTF are you so scared of? And if you do have something to be scared of - stay the fuck home, or in this case, don't be a complete retard and use a "cloud" service to begin with.
So, you would have preferred a positive sounding statement indicating that they are aware that some users have privacy concerns and a vague reference to ongoing efforts to address these concerns?
I didn't find that response "worst of all time". It came across as lacking in the bullshit department, almost refreshingly so, actually.
Steve Gibson's mantra: TNO. If the host has your encryption password/key, then they can't be trusted. If you don't believe that, ask Snowden's email provider, Lavabit's founder Ladar Levison: http://www.wired.com/2014/04/l...
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
I don't need them to do "rich document rendering" (whatever the hell that is) nor do I need them (or anyone else to) index the contents of my files. All I want is for someone to STORE the shit and keep it synced between all my machines. Dropbox does this very well.
As for encryption, I don't have time for that nonsense. Anything sensative such as financials is kept locally on my own server or burned to a DVD and put in the closet. I couldn't care less if someone gets a hold of my vast collection of pictures and documents. It is private, but not going to hurt me if someone at the NSA starts snooping around.
iDrive, which is supposed to be a remote backup service, has a similar problem. They used to be a honest remote backup service, with client-side encryption. (They didn't protect the client password very well on the client machine, but at least the server didn't have it.) File contents were encrypted, but filenames were not, so you could look at logs and the directory tree on line. Then they came out with a "new version" of the service, one that is "web based" and offers "sharing".
For "sharing" to work, of course, they need to know your encryption key. They suggest using the "default encryption key". Even if you're not "sharing", when you want to recover a copy of a file, you're prompted to enter your encryption key onto a web page. The web page immediately sends the encryption key to the server as plain text, as can be seen from a browser log. Asked about this, they first denied the problem, then, when presented with a browser log, refused to answer further questions.
They try real hard to get their hands on your encryption key. After you log into their web site, a huge pop-up demands your encryption key. Without it, some of the menu items at the top of the page still work, and with some difficulty, you can actually find logs of what you backed up. You can't browse your directory tree, though.
It's possible to use the service securely (maybe), but you have to run only the application for recovery, and never use the web-based service. They don't tell you that.
This isn't a free service. I pay them $150 a year.
Try to convince a Manager hellbent on joining "The Cloud" and you know the answer is no.
For a chuckle, have him explain what "The Cloud" is before you do. At least it provides some entertainment before you try to convince him he's about to sink his business.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Also, your hard disk, in your computer, in your house isn't searcheable by law enforcement unless they have a warrant. So keep your stuff at home, and you'll be better off than leaving it on Dropbox (*).
(*) I can see you're unconvinced. Let me spell it out for you: if your file is on Dropbox, then a properly worded warrant needs to be served to Dropbox, and they'll allow searches and copies of anything their hard drives contain. Including your file, your neighbour's file, everybody's files. If everybody keeps their own files at home, then a warrant needs to be served to you, to see your files, but it won't work for your neighbour's files. Another warrant needs to be served to the neighbour to see his files. And it won't work for everybody else. A warrant needs to be served individually to everyone, just to get the same access that Dropbox can give with a single properly worded warrant.
Perhaps "hostile" was unfair, but I appreciate that he said made it sound shocking. I am shocked when I learn people store secret docs unencrypted on Dropbox. Then they are then shocked when I tell them Dropbox is insecure. There should be a lot less shock all around.
That's an accurate and sensible response.
In fact, 3rd party client encryption tools might be better than built-in support by Dropbox. They can be produced outside the USA by companies or individuals unaffiliated with DropBox and potentially harder to pressure into backdooring the software in an update.
I'll stick to SpiderOak personally, despite the awful transfer speeds and somewhat clunky usability, because I just want a remote store that stores my gibberish bytes and gives me the same gibberish bytes back later.
I tried using SpiderOak, but it was a bit too slow for me atm. What I really needed was a off-site backup, so I ended up with Amazon Glacier with client side encryption. Can't beat the price :)
I have dropbox too, and it's ok for it's use. Just have to realize that everything you upload to them is not private anymore.
I wish more services did secure by default and option to reduce security for wanted features.
Yes you'd have to warn the user that a protected folder means exactly that and there are restrictions on what you can do with it, e.g. access in some dropbox clients, web browsers, sharing to others. People will get it.
Even better, this encryption / decryption could be thrown open as a pluggable API so 3rd parties could write their own encryption protocols to whatever personal or corporate standard they desired. For transparency the aforementioned passphrase encryption could even be supplied for review.
Same goes for Skydrive, Google Drive etc. There is no excuse for not offering encryption. Not that I'm in the tinfoil hat camp to think this is to facilitate monitoring (although it does). More likely it's because these cloud storage servers use file hashing to spare themselves the bother of storing 1,000,000 copies of the same file. It still sucks though and even if the option is off by default, encryption of at least one folder should be provided.
Use the web interface to download the file, then decrypt with a local copy of the encryption tool/key.
What they mean is they can't render a document on the web interface.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
As long as you still trust TrueCrypt, there's no reason you shouldn't use an encrypted container file (or multiple smaller containers) in your Dropbox. Some people might not know this, but Dropbox only re-uploads the parts of the file that change (it does a binary comparison), and TrueCrypt typically only updates relatively small sections of the container file when you add/remove/modify a file in the container, so it doesn't take much bandwidth except for the initial upload. Just make sure you dismount frequently enough to allow Dropbox to sync when you make changes. (I'd recommend setting TrueCrypt to automatically dismount after an hour or so of no data being read/written.)
You could use the dynamic disk option when creating the TC container to save bandwidth during the initial upload, if you're starting with an empty container (the size of the container will change, up to a set maximum, to match the contents), but that will have other performance penalties when using the container, and it brings with it the increased risks. In particular, it makes it possible for an analyst to get some idea of how you are storing files in the container, potentially making it easier to break the encryption.
And since it's being stored in the cloud, you should maximize your security by using local keyfiles/tokens rather than a single password. You might as well assume that the whole world has a copy of the container.
For convenience, you can store a portable unencrypted copy of TrueCrypt in Dropbox as well, but you should really only do that if you keep a local copy of the checksums for the binaries and compare them to the files whenever you run them. (That will ensure that nobody has accessed your account and replaced your portable TC binaries with compromised versions capable of stealing your keys.) Or carry a portable version on a USB drive.
The only downside I can see to this is that if you need access to your files on a new machine, you will need to download the whole container, and if the new machine is compromised, you could have your keys stolen. Even so, it's much more secure than using Dropbox on its own, and in my opinion, it's worth the potential inconvenience to have good encryption and cloud access.
So in other words, Dropbox confirmed Snowden's claims.