12 ms·

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s O

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions). - We use elevated access for where the built-in FS APIs come up short. We've been working with Apple to eliminate this dependency and we should have what we need soon. - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). - We check and set privileges on startup — the intent was to make sure Dropbox is functioning properly, works across OS updates, etc. The intent was never to frustrate people or override their choices. We’re all jumping on this. We’ll do a better job here and we’re sorry for any anger, frustration or confusion we’ve caused.

osi 10y ago
It would be awesome to have it not use accessibility APIs. I'm going to be following the instructions to revoke those rights.
seanhunter 10y ago
It's very strange that after I remove Dropbox from the accessibility list you think it's ok to add it back in again. That's the reason I'll be closing my account.
- __jal 10y ago
  Absolutely. I dropped Dropbox some time back, when it became obvious that they didn't respect the user's wishes at all. This has been a long-standing thing with them - some years back there was some stink about the forced Dropbox branding in the Finder (which we now see is related to this). Many people (including me) found it rude that it insists on adding useless widgets, badging icons and inserting crap in the Finder sidebar. For whatever reason, Dropbox (the corporation) apparently believes that junk to be important enough to their business to disregard what the owner of the machine wants, and now we see the lengths they go through to force themselves on the user. I used to simply consider Dropbox rude enough to make me not want to use it. Now that I see the company is actively going out of their way to break the intended function of security-related OS components, I now consider Dropbox malware and will begin warning others about the company.
  - cstejerean 10y ago
    For what it's worth I find the finder icons and sidebar additions to be nice touch, but I guess it would be nice to be able to disable that. The office integration on the other hand is beyond useless. The Dropbox badge mostly gets in the way of being able to scroll trough my documents and I have never used it for anything.
    - ddeville 10y ago
      You can disable the Finder integration in the preferences, same for the badge.
  - danieldk 10y ago
    badging icons and inserting crap in the Finder sidebar Their branding strategy is really annoying. I pay 10 Euro per month for Dropbox Pro, but they have Dropbox Business ads plastered all over the web interface.
- Dylan16807 10y ago
  Most programs don't consider that you might try to explicitly revoke permissions. It's a very understandable bug/behavior. I think it's worth giving them a chance to amend that code.
  - moosemilkie 10y ago
    It didn't even ask for permission the first time.
- jimmaswell 10y ago
  Why would you even do that? What nefarious and yet undiscovered things did you think DropBox was likely to do specifically with the accessibility permission? Permission systems in general seem like a solution without a problem to me. Nobody but a minority of people very concerned about theoretical security problems wanted them on platforms that didn't have them, almost nobody cares what permissions programs use on platforms that have them now, and people get along perfectly fine and with less inconvenience shoved in their face running programs without permissions systems aside from a simple admin rights/no admin rights today on Windows and Linux.
  - guitarbill 10y ago
    Right, they have all your files already, so there's clearly some level of trust.
    - Johnny555 10y ago
      They only have (well should only have) access to the files I share on Dropbox, which is pretty much just music files, so if someone steals those files, I won't be too upset.
    - lucb1e 10y ago
      > they have all your files already Hell no they don't? They have some shared folders between classmates and a few encrypted archives for personal backups.
      - chris_7 10y ago
        1. Dropbox asks for root 2. Dropbox does not use sandboxing (at least, the one I have doesn't) So, they do.
        lucb1e 10y ago
        There is a difference between having all my files and being able to access all my files via a client. 1) My files are not on their service and thus not available at their discretion; they would first have to be uploaded. 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. That said, I do see your point. Most desktop applications (as opposed to mobile apps) are capable of a lot more than they need to, and even many popular mobile apps are. I just wouldn't say I implicitly trust them with all of my files.
- derptron 10y ago
  I closed my account when they put a former Secretary of State and National Security Advisor on the Board of Directors for no apparent reason.
deleted 10y ago
[deleted]
dogecoinbase 10y ago
The dialog box you see is a native OS X API (i.e. made by Apple). Which API are you using that allows you to circumvent the OS X Accessibility Permissions control dialog? Or do you mean you're simply asking for administrative permissions in order to write directly to TCC.db? And in that case, what mechanism are you using to circumvent the permissions structure to permit you to rewrite to TCC.db without re-requesting the user's permission?
- fifafu 10y ago
  The Accessibility Permissions dialogue doesn't just show up. You as a developer can control when it is shown (using AXIsProcessTrustedWithOptions).
aioprisan 10y ago
I still don't understand how this allows for accessibility circumvention dialog.
- redial 10y ago
  If I understood correctly, using the root permission granted by the user when the prompt for the password comes up, they hack the database containing the accessibility settings, and add themselves to the list.
xenadu02 10y ago
Can you also tell us why Dropbox eats lots of CPU cycles anytime there is any filesystem activity? If I unzip a large archive in /tmp, Dropbox is eating 60% of my CPU. If I open the new Xcode for the first time (and the system verifies all the signatures) Dropbox is eating 100% of one CPU. It really seems like the Dropbox client is monitoring the entire filesystem (all FSEvents) instead of just the dropbox syncing folders, and doing it relatively inefficiently at that. At this point if I'm doing anything filesystem intensive I close Dropbox first.
- gnicholas 10y ago
  I uninstalled the desktop client because of this exact issue. I just drag/drop via the web interface now. Might not work for some people, but it suits me fine.
  - dawnerd 10y ago
    Just uninstalled too. I was only using it for syncing 1password data and this pushed me to just switch to a 1pass account
    - jrnichols 10y ago
      1password has had iCloud syncing for a while now, and in my experience, it's been very reliable.
  - ikurei 10y ago
    If you think they are so nefarious a company, why do you trust them with your files?
    - gnicholas 10y ago
      Didn't say they were nefarious—just that their software hogs resources at times when it has no business doing so (i.e., when I'm not reading from or writing to my Dropbox folder).
- 10y ago
youngtaff 10y ago
That office integration is a PITA, is there anyway to disable it?
- niij 10y ago
  On a Mac: Click Dropbox Icon in the menubar -> Options (gear in bottom right) -> General -> set Dropbox badge to "Never Show"
elmigranto 10y ago
> We use elevated access for where the built-in FS APIs come up short. Can you please provide an example of such shortcomings and accessibility APIs that are better?
- therein 10y ago
  Setting the icon of a folder. Seriously. That's what they are using it for.
riobard 10y ago
At this point you need to follow up with convincing technical details of why Dropbox needs the circumvention to counter the accusation and rebuild the damaged trust. The reason for needing Accessibility API listed in your response is pretty vague, especially for those Mac users not having Microsoft products tainting their systems. I've deleted Dropbox from my Mac for now. I'm not installing it back till there's reasonable explanation and remedies.
- ch4s3 10y ago
  I agree with you general sentiment, but would Word or Excel really "taint" your system?
  - techer 10y ago
    Morally?
    - ch4s3 10y ago
      Vs. Apple? That seems thin...
      - 4ad 10y ago
        Not everyone shares your same sense of morality.
      - jedikv 10y ago
        Fanboys be blind to the hypocrisy and all that jazz...
  - JadeNB 10y ago
    I can't stand the `~/Documents/"Microsoft User Data"` folder, but that's what I get any time I open an Office app.
- moefogs 10y ago
  Let's be honest about this. Dropbox has always been awful with security. They used to flat out lie about encryption (pretending they encrypted server side, when they weren't at all). They've had numerous other incidents, including ones where Arash treated affected customers horribly. Dropbox has hired some good people, but the foundation consists of a great CEO, and a customer-hostile CTO who doesn't give a fuck about security. It will NEVER be a good product because of that. Drew Houston would be WAY wealthier today if he'd fired that worthless piece of shit he calls a CTO years ago.
infodroid 10y ago
In the long run, the best way to demonstrate that your software is trustworthy is to release the source code for your client software under an open source license.
ROFISH 10y ago
I really wish there was some type of option to go "I really don't want all that fancy crap; give me the version that works via standard APIs"
- 762236 10y ago
  That is the web UI.
kybernetyk 10y ago
>but unfortunately some of the permissions aren’t as granular as we would like. Nice euphemism for "catch all" permissions...
partycoder 10y ago
Now a malware can target your scripts and get a free ride to all your system yay.
DINKDINK 10y ago
>We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). If that's the case, How is it that the accessibility preferences are changed without root authorization?
- pilif 10y ago
  Once you type your password into the Apple dialog, you grant Dropbox root access. That's the purpose of this dialog in all cases.
  - hughw 10y ago
    Per the original article, even root doesn't automatically have permission to modify the system.preferences.accessibility list.
    - lucb1e 10y ago
      I think you're wrong. It's a bit vague with all the unfamiliar systems (I have no experience with OS X), but root is mentioned in a few places: > "The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false" So the agent does not (by default) make an exception for applications running with uid 0. It does not say anything about modifying a certain file, it's just about the agent (if I understand it correctly). > "In other words, if allow-root isn’t explicitly set, the default is that even a process with root user privileges does not have the right to perform that operation. Since that’s not specified in the default shown above, then even root couldn’t add Dropbox to the list of apps in Accessibility preferences." Same thing again. Agent won't allow, but file permissions are not mentioned. > "Root wasn’t allowed to override Accessibility, and authenticate was on, so it couldn’t be this way that Dropbox was hacking my mac." Same again. And that's all places where root is mentioned. Later on, however, sudo is used: > "To insert an app in the list, you grab it’s bundle identifier (in the case of Dropbox, that’s com.getdropbox.dropbox), and issue: > sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db “REPLACE INTO access VALUES(‘kTCCServiceAccessibility’,’com.getdropbox.dropbox’,0,1,1,NULL, NULL);”" So sudo, which makes a command run as root, can modify that database. And as far as I know this makes sense, because at least in Linux file permissions are simply not checked when uid is 0 (root user). Darwin/BSD might differ, but my unix family tree knowledge doesn't go that far. Also, how else could Dropbox do it? As mentioned in the article, one of the helper applications contains an SQL statement (see the part about running "strings"), so it does seem to be directly modifying that database.
alberth 10y ago
@newhouseb Off topic: can you help me understand why when a file is locked (e.g. Outlook accessing .PST file) this causes Dropbox to peg the CPU to 100%. I've opened multiple bug reports over the years and support dismisses my finding. This makes Dropbox un-usable for me. I literally have to run Dropbox as "paused" 90% of the time and only "unpause" Dropbox when I close Outlook.
bitserf 10y ago
Uh, nope. You've just ensured Dropbox will never be installed again on any of my machines or devices. Ever. You fuck up like this, you never earn that trust back.
hughw 10y ago
> The intent was never to frustrate people or override their choices When you designed an agent that specifically overrides the user's choice to turn off Accessibility rights for Dropbox, frustrating that attempt, I suspect that was intentional.
- halostatue 10y ago
  Note: not excusing Dropbox, but understanding how they reached here. Bob (who less technically savvy) installs Dropbox for use with Office. Chuck (someone more technical than Bob) removes Dropbox from the accessibility list. Chuck has now broken Bob’s Dropbox, and Bob (being less technically savvy) blames Dropbox resulting in another ongoing thread about broken Dropbox. I completely understand how Dropbox reached this point, and purely from a technical support point of view, how it is justified. There are probably better ways for them to have done this (still have the “hack”, but only insert it if Office applications are detected to be installed; have an option that can turn it off even if Office is installed, but warn about it and make it “easy” to turn back on).
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
brentdax 10y ago
> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install these. (I don't work for Dropbox or anything; I've just been poking around.) > - We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions). @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? I understand the desire to make your features "just work", but circumventing the user's privacy controls to do that is never acceptable. Especially accessibility, which is basically a general warrant to snoop on everything the user does. You wouldn't be on my system anymore if my work didn't require Dropbox. You're going to lose a lot of trust over this, and it won't even be half of what you deserve. And it's not even in your interest in the long term. This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement. Since Dropbox can't really do its job when it's locked in a sandbox, I really don't think that's what you guys want to happen. Teams like yours are why we can't have nice things. (P.S. plz respect NSFileCoordinator this isn't Tiger anymore kthxbai)
- mikewhy 10y ago
  Not from Dropbox but when you remove an app from accessibility permissions OS X will make you manually enable it again.
  - X-Cubed 10y ago
    mikewhy: The article states that it re-adds itself to the list automatically the next time you log in, without asking for permission again. There's no option to keep it permanently disabled.
    - 10y ago
deleted 10y ago
[deleted]
SSLy 10y ago
>We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). Is it a native OS X dialog API, or native OS X authentication API? I could make a password prompt myself, and call that "being official Win32 API". Can you show me the class where you invoke it, so I can judge for myself?
- tjl 10y ago
  It's a standard OS X authentication API. The overview of the authorization stuff is discussed in: https://developer.apple.com/library/mac/documentation/Security/Conceptual/authorization_concepts/01introduction/introduction.html#//apple_ref/doc/uid/TP30000995 https://developer.apple.com/library/mac/documentation/Securi... If you look under "Authorization Services Tasks" you'll see there's details about calling a privileged installer.
Animats 10y ago
"We use elevated access for where the built-in FS APIs come up short." One wonders what Dropbox would say if someone decided to obtain elevated access on their servers by surreptitious means because Dropbox's API "came up short".[1] [1] https://www.dropboxforum.com/hc/en-us/community/posts/204550635-The-shares-API-looks-to-have-bug https://www.dropboxforum.com/hc/en-us/community/posts/204550...
frik 10y ago
I removed the Dropbox app from my iPad when they started to require a active GPS to upload files. [about two years ago] If you disallow GPS for that app, it disallows you to upload files. Stupid decisions!?
- yborg 10y ago
  wat. I just checked, I have Location Services set to 'Never' on Dropbox and it uploads files fine.
  - frik 10y ago
    It was about two years ago. I removed the app, never looked back. But recently came across a news that Dropbox got hacked and all passwords were captured and leaked. At the same time I received an email from them, not mentioning that (as far as I remember) but what they mentioned they will delete my account if I don't login in the next x weeks. It seems Dropbox had its peak, and it's going down-hill from there -except they do an IPO or find a someone to sell (maybe they already do just that).
allending 10y ago
Office Integrations: Worthless for a huge swath of users who don't have Office. Also undesirable for a large group of users who have Office but have no use for the integration. Other Integrations: Too vague to justify what is potentially a large security threat. You've really got to do better than that.
iomike 10y ago
No problem. I've deleted dropbox and looking at alternatives. So far, they're cheaper for more space and don't pull this bullshit.
angry_octet 10y ago
You are really just digging the hole deeper at this point. This needs a mea maxima culpa. Apple really should kick you from the App Store and blacklist dropbox as malware.
- jads 10y ago
  I don't think Dropbox is listed on the App Store (I doubt it meets the sandboxing restrictions)
  - tjl 10y ago
    Upgrading your privileges is against sandboxing rules, so no it can't be sandboxed.
  - angry_octet 10y ago
    I meant the IOS App Store, not the Mac App Store. But this does highlight why Mac App Store app restrictions exist. Re blacklisting, I'm referring to Apple's Xprotect (https://www.intego.com/mac-security-blog/topic/xprotect/ https://www.intego.com/mac-security-blog/topic/xprotect/).
- deleted 10y ago
  [deleted]
snarshad 10y ago
Regardless of the password issue, if you are legitimately working with Apple to get the granular access to implement the useful features you want, why would you in the meantime subvert Apple security mechanisms (by using a sql vulnerability - this already more than qualifies you as malware IMO) to sneak the features in rather than asking the user to grant the accessibility permission?? No, this is more than a "my bad," this is deceit and violating.
zenexer 10y ago
I'm not really concerned about Dropbox's intentions, or even the accessibility integration. What worries me is: - There are numerous setuid binaries without any documentation or source code available. These have the potential to breed nasty zero-day privilege escalation exploits, possibly worse. - Dropbox goes out of its way to obfuscate its Python bytecode. This doesn't prevent intellectual property theft: there will always be people capable of reverse engineering it (e.g., https://github.com/rumpeltux/dropboxdec https://github.com/rumpeltux/dropboxdec). The only effect that it has is to significantly decrease the security of the application: technical users can't easily review the inner workings without a substantial time investment. Hackers, on the other hand, have massive profits to gain from reverse engineering something as popular as Dropbox, and won't hesitate to do so. This represents a lack of regard for security on Dropbox's part, indicating that they favor intellectual property protection over the security of their customers. When I buy a car, I can open it up, check the brakes, and be sure I'm not going to crash into a tree. I expect to be able to do the same with the software on my computer.
- zenexer 10y ago
  It looks like DropboxHelperInstaller can be used to extract an arbitrary tarball as root into /Library/DropboxHelperTools, preserving permissions. It takes two arguments: the first is a number (doesn't seem to matter--maybe PPID for callback?) and the second is the bath to the GZIP'd tarball. It seems to require that the tarball have an RSA signature appended to the end, but there are signs that the check may be less than ideal and possible to circumvent. Output from extracting a Dropbox-signed tarball (in this case, DropboxHelperInstall's own tarball): <pid>52229</pid> crypto error while Verifying Signature: block type is not 01 (in rsa routines:RSA_padding_check_PKCS1_type_1) crypto error while Verifying Signature: padding check failed (in rsa routines:RSA_EAY_PUBLIC_DECRYPT) mkdir '/Library/DropboxHelperTools' 0755 -> 17 extracting ./._DropboxHelperInstaller extracting DropboxHelperInstaller <ok> Output from attempt to extract a third-party tarball: <pid>52286</pid> missing magic number unable to read_digest couldn't verify signature <failure> -1 Output from attempt to extract a third-party tarball with the signature copied from a Dropbox tarball: <pid>52142</pid> crypto error while Verifying Signature: block type is not 01 (in rsa routines:RSA_padding_check_PKCS1_type_1) crypto error while Verifying Signature: padding check failed (in rsa routines:RSA_EAY_PUBLIC_DECRYPT) crypto error while Verifying Signature: bad signature (in rsa routines:INT_RSA_VERIFY) couldn't verify signature <failure> -1 It's probably worth reverse engineering DropboxHelperInstaller to ensure that the signature check can't be evaded. Even then, I'm not sure I like the idea of anyone with Dropbox's private key being able to install arbitrary setuid binaries on my machine. Given recent events, it's quite possible the private key has already been stolen.
tinus_hn 10y ago
> We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. And as for the rest of the privileges, we just take them without asking. Who knows, someone might refuse!

osi 10y ago

It would be awesome to have it not use accessibility APIs. I'm going to be following the instructions to revoke those rights.

seanhunter 10y ago

It's very strange that after I remove Dropbox from the accessibility list you think it's ok to add it back in again. That's the reason I'll be closing my account.

__jal 10y ago
Absolutely. I dropped Dropbox some time back, when it became obvious that they didn't respect the user's wishes at all. This has been a long-standing thing with them - some years back there was some stink about the forced Dropbox branding in the Finder (which we now see is related to this). Many people (including me) found it rude that it insists on adding useless widgets, badging icons and inserting crap in the Finder sidebar. For whatever reason, Dropbox (the corporation) apparently believes that junk to be important enough to their business to disregard what the owner of the machine wants, and now we see the lengths they go through to force themselves on the user. I used to simply consider Dropbox rude enough to make me not want to use it. Now that I see the company is actively going out of their way to break the intended function of security-related OS components, I now consider Dropbox malware and will begin warning others about the company.
- cstejerean 10y ago
  For what it's worth I find the finder icons and sidebar additions to be nice touch, but I guess it would be nice to be able to disable that. The office integration on the other hand is beyond useless. The Dropbox badge mostly gets in the way of being able to scroll trough my documents and I have never used it for anything.
  - ddeville 10y ago
    You can disable the Finder integration in the preferences, same for the badge.
- danieldk 10y ago
  badging icons and inserting crap in the Finder sidebar Their branding strategy is really annoying. I pay 10 Euro per month for Dropbox Pro, but they have Dropbox Business ads plastered all over the web interface.
Dylan16807 10y ago
Most programs don't consider that you might try to explicitly revoke permissions. It's a very understandable bug/behavior. I think it's worth giving them a chance to amend that code.
- moosemilkie 10y ago
  It didn't even ask for permission the first time.
jimmaswell 10y ago
Why would you even do that? What nefarious and yet undiscovered things did you think DropBox was likely to do specifically with the accessibility permission? Permission systems in general seem like a solution without a problem to me. Nobody but a minority of people very concerned about theoretical security problems wanted them on platforms that didn't have them, almost nobody cares what permissions programs use on platforms that have them now, and people get along perfectly fine and with less inconvenience shoved in their face running programs without permissions systems aside from a simple admin rights/no admin rights today on Windows and Linux.
- guitarbill 10y ago
  Right, they have all your files already, so there's clearly some level of trust.
  - Johnny555 10y ago
    They only have (well should only have) access to the files I share on Dropbox, which is pretty much just music files, so if someone steals those files, I won't be too upset.
  - lucb1e 10y ago
    > they have all your files already Hell no they don't? They have some shared folders between classmates and a few encrypted archives for personal backups.
    - chris_7 10y ago
      1. Dropbox asks for root 2. Dropbox does not use sandboxing (at least, the one I have doesn't) So, they do.
      - lucb1e 10y ago
        There is a difference between having all my files and being able to access all my files via a client. 1) My files are not on their service and thus not available at their discretion; they would first have to be uploaded. 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. That said, I do see your point. Most desktop applications (as opposed to mobile apps) are capable of a lot more than they need to, and even many popular mobile apps are. I just wouldn't say I implicitly trust them with all of my files.
derptron 10y ago
I closed my account when they put a former Secretary of State and National Security Advisor on the Board of Directors for no apparent reason.

deleted 10y ago

[deleted]

dogecoinbase 10y ago

The dialog box you see is a native OS X API (i.e. made by Apple). Which API are you using that allows you to circumvent the OS X Accessibility Permissions control dialog? Or do you mean you're simply asking for administrative permissions in order to write directly to TCC.db? And in that case, what mechanism are you using to circumvent the permissions structure to permit you to rewrite to TCC.db without re-requesting the user's permission?

fifafu 10y ago
The Accessibility Permissions dialogue doesn't just show up. You as a developer can control when it is shown (using AXIsProcessTrustedWithOptions).

aioprisan 10y ago

I still don't understand how this allows for accessibility circumvention dialog.

redial 10y ago
If I understood correctly, using the root permission granted by the user when the prompt for the password comes up, they hack the database containing the accessibility settings, and add themselves to the list.

xenadu02 10y ago

Can you also tell us why Dropbox eats lots of CPU cycles anytime there is any filesystem activity? If I unzip a large archive in /tmp, Dropbox is eating 60% of my CPU. If I open the new Xcode for the first time (and the system verifies all the signatures) Dropbox is eating 100% of one CPU. It really seems like the Dropbox client is monitoring the entire filesystem (all FSEvents) instead of just the dropbox syncing folders, and doing it relatively inefficiently at that. At this point if I'm doing anything filesystem intensive I close Dropbox first.

gnicholas 10y ago
I uninstalled the desktop client because of this exact issue. I just drag/drop via the web interface now. Might not work for some people, but it suits me fine.
- dawnerd 10y ago
  Just uninstalled too. I was only using it for syncing 1password data and this pushed me to just switch to a 1pass account
  - jrnichols 10y ago
    1password has had iCloud syncing for a while now, and in my experience, it's been very reliable.
- ikurei 10y ago
  If you think they are so nefarious a company, why do you trust them with your files?
  - gnicholas 10y ago
    Didn't say they were nefarious—just that their software hogs resources at times when it has no business doing so (i.e., when I'm not reading from or writing to my Dropbox folder).
10y ago

youngtaff 10y ago

That office integration is a PITA, is there anyway to disable it?

niij 10y ago
On a Mac: Click Dropbox Icon in the menubar -> Options (gear in bottom right) -> General -> set Dropbox badge to "Never Show"

elmigranto 10y ago

> We use elevated access for where the built-in FS APIs come up short. Can you please provide an example of such shortcomings and accessibility APIs that are better?

therein 10y ago
Setting the icon of a folder. Seriously. That's what they are using it for.

riobard 10y ago

At this point you need to follow up with convincing technical details of why Dropbox needs the circumvention to counter the accusation and rebuild the damaged trust. The reason for needing Accessibility API listed in your response is pretty vague, especially for those Mac users not having Microsoft products tainting their systems. I've deleted Dropbox from my Mac for now. I'm not installing it back till there's reasonable explanation and remedies.

ch4s3 10y ago
I agree with you general sentiment, but would Word or Excel really "taint" your system?
- techer 10y ago
  Morally?
  - ch4s3 10y ago
    Vs. Apple? That seems thin...
    - 4ad 10y ago
      Not everyone shares your same sense of morality.
    - jedikv 10y ago
      Fanboys be blind to the hypocrisy and all that jazz...
- JadeNB 10y ago
  I can't stand the `~/Documents/"Microsoft User Data"` folder, but that's what I get any time I open an Office app.
moefogs 10y ago
Let's be honest about this. Dropbox has always been awful with security. They used to flat out lie about encryption (pretending they encrypted server side, when they weren't at all). They've had numerous other incidents, including ones where Arash treated affected customers horribly. Dropbox has hired some good people, but the foundation consists of a great CEO, and a customer-hostile CTO who doesn't give a fuck about security. It will NEVER be a good product because of that. Drew Houston would be WAY wealthier today if he'd fired that worthless piece of shit he calls a CTO years ago.

infodroid 10y ago

In the long run, the best way to demonstrate that your software is trustworthy is to release the source code for your client software under an open source license.

ROFISH 10y ago

I really wish there was some type of option to go "I really don't want all that fancy crap; give me the version that works via standard APIs"

762236 10y ago
That is the web UI.

kybernetyk 10y ago

>but unfortunately some of the permissions aren’t as granular as we would like. Nice euphemism for "catch all" permissions...

partycoder 10y ago

Now a malware can target your scripts and get a free ride to all your system yay.

DINKDINK 10y ago

>We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). If that's the case, How is it that the accessibility preferences are changed without root authorization?

pilif 10y ago
Once you type your password into the Apple dialog, you grant Dropbox root access. That's the purpose of this dialog in all cases.
- hughw 10y ago
  Per the original article, even root doesn't automatically have permission to modify the system.preferences.accessibility list.
  - lucb1e 10y ago
    I think you're wrong. It's a bit vague with all the unfamiliar systems (I have no experience with OS X), but root is mentioned in a few places: > "The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false" So the agent does not (by default) make an exception for applications running with uid 0. It does not say anything about modifying a certain file, it's just about the agent (if I understand it correctly). > "In other words, if allow-root isn’t explicitly set, the default is that even a process with root user privileges does not have the right to perform that operation. Since that’s not specified in the default shown above, then even root couldn’t add Dropbox to the list of apps in Accessibility preferences." Same thing again. Agent won't allow, but file permissions are not mentioned. > "Root wasn’t allowed to override Accessibility, and authenticate was on, so it couldn’t be this way that Dropbox was hacking my mac." Same again. And that's all places where root is mentioned. Later on, however, sudo is used: > "To insert an app in the list, you grab it’s bundle identifier (in the case of Dropbox, that’s com.getdropbox.dropbox), and issue: > sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db “REPLACE INTO access VALUES(‘kTCCServiceAccessibility’,’com.getdropbox.dropbox’,0,1,1,NULL, NULL);”" So sudo, which makes a command run as root, can modify that database. And as far as I know this makes sense, because at least in Linux file permissions are simply not checked when uid is 0 (root user). Darwin/BSD might differ, but my unix family tree knowledge doesn't go that far. Also, how else could Dropbox do it? As mentioned in the article, one of the helper applications contains an SQL statement (see the part about running "strings"), so it does seem to be directly modifying that database.

alberth 10y ago

@newhouseb Off topic: can you help me understand why when a file is locked (e.g. Outlook accessing .PST file) this causes Dropbox to peg the CPU to 100%. I've opened multiple bug reports over the years and support dismisses my finding. This makes Dropbox un-usable for me. I literally have to run Dropbox as "paused" 90% of the time and only "unpause" Dropbox when I close Outlook.

bitserf 10y ago

Uh, nope. You've just ensured Dropbox will never be installed again on any of my machines or devices. Ever. You fuck up like this, you never earn that trust back.

hughw 10y ago

> The intent was never to frustrate people or override their choices When you designed an agent that specifically overrides the user's choice to turn off Accessibility rights for Dropbox, frustrating that attempt, I suspect that was intentional.

halostatue 10y ago
Note: not excusing Dropbox, but understanding how they reached here. Bob (who less technically savvy) installs Dropbox for use with Office. Chuck (someone more technical than Bob) removes Dropbox from the accessibility list. Chuck has now broken Bob’s Dropbox, and Bob (being less technically savvy) blames Dropbox resulting in another ongoing thread about broken Dropbox. I completely understand how Dropbox reached this point, and purely from a technical support point of view, how it is justified. There are probably better ways for them to have done this (still have the “hack”, but only insert it if Office applications are detected to be installed; have an option that can turn it off even if Office is installed, but warn about it and make it “easy” to turn back on).

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

brentdax 10y ago

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install these. (I don't work for Dropbox or anything; I've just been poking around.) > - We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions). @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? I understand the desire to make your features "just work", but circumventing the user's privacy controls to do that is never acceptable. Especially accessibility, which is basically a general warrant to snoop on everything the user does. You wouldn't be on my system anymore if my work didn't require Dropbox. You're going to lose a lot of trust over this, and it won't even be half of what you deserve. And it's not even in your interest in the long term. This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement. Since Dropbox can't really do its job when it's locked in a sandbox, I really don't think that's what you guys want to happen. Teams like yours are why we can't have nice things. (P.S. plz respect NSFileCoordinator this isn't Tiger anymore kthxbai)

mikewhy 10y ago
Not from Dropbox but when you remove an app from accessibility permissions OS X will make you manually enable it again.
- X-Cubed 10y ago
  mikewhy: The article states that it re-adds itself to the list automatically the next time you log in, without asking for permission again. There's no option to keep it permanently disabled.
  - 10y ago

deleted 10y ago

[deleted]

SSLy 10y ago

>We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). Is it a native OS X dialog API, or native OS X authentication API? I could make a password prompt myself, and call that "being official Win32 API". Can you show me the class where you invoke it, so I can judge for myself?

tjl 10y ago
It's a standard OS X authentication API. The overview of the authorization stuff is discussed in: https://developer.apple.com/library/mac/documentation/Security/Conceptual/authorization_concepts/01introduction/introduction.html#//apple_ref/doc/uid/TP30000995 https://developer.apple.com/library/mac/documentation/Securi... If you look under "Authorization Services Tasks" you'll see there's details about calling a privileged installer.

Animats 10y ago

"We use elevated access for where the built-in FS APIs come up short." One wonders what Dropbox would say if someone decided to obtain elevated access on their servers by surreptitious means because Dropbox's API "came up short".[1] [1] https://www.dropboxforum.com/hc/en-us/community/posts/204550635-The-shares-API-looks-to-have-bug https://www.dropboxforum.com/hc/en-us/community/posts/204550...

frik 10y ago

I removed the Dropbox app from my iPad when they started to require a active GPS to upload files. [about two years ago] If you disallow GPS for that app, it disallows you to upload files. Stupid decisions!?

yborg 10y ago
wat. I just checked, I have Location Services set to 'Never' on Dropbox and it uploads files fine.
- frik 10y ago
  It was about two years ago. I removed the app, never looked back. But recently came across a news that Dropbox got hacked and all passwords were captured and leaked. At the same time I received an email from them, not mentioning that (as far as I remember) but what they mentioned they will delete my account if I don't login in the next x weeks. It seems Dropbox had its peak, and it's going down-hill from there -except they do an IPO or find a someone to sell (maybe they already do just that).

allending 10y ago

Office Integrations: Worthless for a huge swath of users who don't have Office. Also undesirable for a large group of users who have Office but have no use for the integration. Other Integrations: Too vague to justify what is potentially a large security threat. You've really got to do better than that.

iomike 10y ago

No problem. I've deleted dropbox and looking at alternatives. So far, they're cheaper for more space and don't pull this bullshit.

angry_octet 10y ago

You are really just digging the hole deeper at this point. This needs a mea maxima culpa. Apple really should kick you from the App Store and blacklist dropbox as malware.

jads 10y ago
I don't think Dropbox is listed on the App Store (I doubt it meets the sandboxing restrictions)
- tjl 10y ago
  Upgrading your privileges is against sandboxing rules, so no it can't be sandboxed.
- angry_octet 10y ago
  I meant the IOS App Store, not the Mac App Store. But this does highlight why Mac App Store app restrictions exist. Re blacklisting, I'm referring to Apple's Xprotect (https://www.intego.com/mac-security-blog/topic/xprotect/ https://www.intego.com/mac-security-blog/topic/xprotect/).
deleted 10y ago
[deleted]

snarshad 10y ago

Regardless of the password issue, if you are legitimately working with Apple to get the granular access to implement the useful features you want, why would you in the meantime subvert Apple security mechanisms (by using a sql vulnerability - this already more than qualifies you as malware IMO) to sneak the features in rather than asking the user to grant the accessibility permission?? No, this is more than a "my bad," this is deceit and violating.

zenexer 10y ago

I'm not really concerned about Dropbox's intentions, or even the accessibility integration. What worries me is: - There are numerous setuid binaries without any documentation or source code available. These have the potential to breed nasty zero-day privilege escalation exploits, possibly worse. - Dropbox goes out of its way to obfuscate its Python bytecode. This doesn't prevent intellectual property theft: there will always be people capable of reverse engineering it (e.g., https://github.com/rumpeltux/dropboxdec https://github.com/rumpeltux/dropboxdec). The only effect that it has is to significantly decrease the security of the application: technical users can't easily review the inner workings without a substantial time investment. Hackers, on the other hand, have massive profits to gain from reverse engineering something as popular as Dropbox, and won't hesitate to do so. This represents a lack of regard for security on Dropbox's part, indicating that they favor intellectual property protection over the security of their customers. When I buy a car, I can open it up, check the brakes, and be sure I'm not going to crash into a tree. I expect to be able to do the same with the software on my computer.

zenexer 10y ago
It looks like DropboxHelperInstaller can be used to extract an arbitrary tarball as root into /Library/DropboxHelperTools, preserving permissions. It takes two arguments: the first is a number (doesn't seem to matter--maybe PPID for callback?) and the second is the bath to the GZIP'd tarball. It seems to require that the tarball have an RSA signature appended to the end, but there are signs that the check may be less than ideal and possible to circumvent. Output from extracting a Dropbox-signed tarball (in this case, DropboxHelperInstall's own tarball): <pid>52229</pid> crypto error while Verifying Signature: block type is not 01 (in rsa routines:RSA_padding_check_PKCS1_type_1) crypto error while Verifying Signature: padding check failed (in rsa routines:RSA_EAY_PUBLIC_DECRYPT) mkdir '/Library/DropboxHelperTools' 0755 -> 17 extracting ./._DropboxHelperInstaller extracting DropboxHelperInstaller <ok> Output from attempt to extract a third-party tarball: <pid>52286</pid> missing magic number unable to read_digest couldn't verify signature <failure> -1 Output from attempt to extract a third-party tarball with the signature copied from a Dropbox tarball: <pid>52142</pid> crypto error while Verifying Signature: block type is not 01 (in rsa routines:RSA_padding_check_PKCS1_type_1) crypto error while Verifying Signature: padding check failed (in rsa routines:RSA_EAY_PUBLIC_DECRYPT) crypto error while Verifying Signature: bad signature (in rsa routines:INT_RSA_VERIFY) couldn't verify signature <failure> -1 It's probably worth reverse engineering DropboxHelperInstaller to ensure that the signature check can't be evaded. Even then, I'm not sure I like the idea of anyone with Dropbox's private key being able to install arbitrary setuid binaries on my machine. Given recent events, it's quite possible the private key has already been stolen.

tinus_hn 10y ago

> We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. And as for the rest of the privileges, we just take them without asking. Who knows, someone might refuse!