4 ms·

Why would you even do that? What nefarious and yet undiscovered things did you think DropBox was likely to do specifically with the accessibility permission? P

Why would you even do that? What nefarious and yet undiscovered things did you think DropBox was likely to do specifically with the accessibility permission? Permission systems in general seem like a solution without a problem to me. Nobody but a minority of people very concerned about theoretical security problems wanted them on platforms that didn't have them, almost nobody cares what permissions programs use on platforms that have them now, and people get along perfectly fine and with less inconvenience shoved in their face running programs without permissions systems aside from a simple admin rights/no admin rights today on Windows and Linux.

guitarbill 10y ago
Right, they have all your files already, so there's clearly some level of trust.
- Johnny555 10y ago
  They only have (well should only have) access to the files I share on Dropbox, which is pretty much just music files, so if someone steals those files, I won't be too upset.
- lucb1e 10y ago
  > they have all your files already Hell no they don't? They have some shared folders between classmates and a few encrypted archives for personal backups.
  - chris_7 10y ago
    1. Dropbox asks for root 2. Dropbox does not use sandboxing (at least, the one I have doesn't) So, they do.
    - lucb1e 10y ago
      There is a difference between having all my files and being able to access all my files via a client. 1) My files are not on their service and thus not available at their discretion; they would first have to be uploaded. 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. That said, I do see your point. Most desktop applications (as opposed to mobile apps) are capable of a lot more than they need to, and even many popular mobile apps are. I just wouldn't say I implicitly trust them with all of my files.
      - chris_7 10y ago
        > 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. On macOS this is not true though, for well-behaved document-based apps! Sandboxing prevents access to anything you haven't explicitly granted access to. I don't know if Libreoffice implements it correctly, though.
        danieldk 10y ago
        And before someone says that this is not feasible for a Dropbox-like application: OneDrive is distributed via the App Store (with its sandboxing requirements).
    - guitarbill 10y ago
      There's been some downvotes (thanks for the constructive feedback /s), but I'd agree that this is a better way to put it. Anything that asks for root has 100% access at that moment, and possibly in future. It's easy to forget with all the "training" that `sudo`and confirmation dialogs provide, but true. Heck, if you install something (and by install I mean allow itself to integrate into the system, as opposed to say a script), you have to trust something. Either you trust the issuer, the package maintainers, or yourself (after you've checked 100% of the source code and compile it), but there's trust at some point.
djsumdog 10y ago
What if Dropbox has an exploit they're unaware of. Someone finds a whole in Dropbox and boom, now they have accessibility access. Even if you trust the software vendor, security concerns can cascade.
- lucb1e 10y ago
  This got downvoted and I'd like to know why. This was one of my first thoughts as well while reading the article: what if Dropbox gets hacked? Their client apparently has access to everything. What if the hack pushes a rogue client? Or one CDN endpoint serves a malicious update? Or a little bit of code is sneaked into the development process? Or an employee gets sour? Or a million other things that you hope never happen. There is a reason we don't run apache/nginx/any networked service as root. (You don't, right?)
__jal 10y ago
> and people get along perfectly fine and with less inconvenience shoved in their face running programs without permissions systems aside from a simple admin rights/no admin rights [...] ...For values of "perfectly fine" that include millions of malware slaves on the net, hundreds of millions of stolen passwords, targeted 0 days attacking human rights workers, file-encryptor extortion apps, etc. etc. etc. > What nefarious and yet undiscovered things If they're undiscovered, how am I supposed to list them? As far as discovered things, the permission allows Dropbox to sniff the keyboard and interact with any other application as the user. Add that to unrestricted filesystem access, and the right question to ask is what nefarious things Dropbox can't do.
skywhopper 10y ago
I prefer to know what the apps I install are going to be doing. To this end, OS-enforced permissions for using various services are a godsend. No program should need "admin" rights. And I should be able to know and control what each app I run can and cannot do. This seems utterly obvious to me. Even if most people dont' care, the tools should be there. There've been more than enough cases where apps have collected information they shouldn't have, whether intentionally or lazily. It baffles me that anyone could seriously make the argument you seem to be making.

guitarbill 10y ago

Right, they have all your files already, so there's clearly some level of trust.

Johnny555 10y ago
They only have (well should only have) access to the files I share on Dropbox, which is pretty much just music files, so if someone steals those files, I won't be too upset.
lucb1e 10y ago
> they have all your files already Hell no they don't? They have some shared folders between classmates and a few encrypted archives for personal backups.
- chris_7 10y ago
  1. Dropbox asks for root 2. Dropbox does not use sandboxing (at least, the one I have doesn't) So, they do.
  - lucb1e 10y ago
    There is a difference between having all my files and being able to access all my files via a client. 1) My files are not on their service and thus not available at their discretion; they would first have to be uploaded. 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. That said, I do see your point. Most desktop applications (as opposed to mobile apps) are capable of a lot more than they need to, and even many popular mobile apps are. I just wouldn't say I implicitly trust them with all of my files.
    - chris_7 10y ago
      > 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. On macOS this is not true though, for well-behaved document-based apps! Sandboxing prevents access to anything you haven't explicitly granted access to. I don't know if Libreoffice implements it correctly, though.
      - danieldk 10y ago
        And before someone says that this is not feasible for a Dropbox-like application: OneDrive is distributed via the App Store (with its sandboxing requirements).
  - guitarbill 10y ago
    There's been some downvotes (thanks for the constructive feedback /s), but I'd agree that this is a better way to put it. Anything that asks for root has 100% access at that moment, and possibly in future. It's easy to forget with all the "training" that `sudo`and confirmation dialogs provide, but true. Heck, if you install something (and by install I mean allow itself to integrate into the system, as opposed to say a script), you have to trust something. Either you trust the issuer, the package maintainers, or yourself (after you've checked 100% of the source code and compile it), but there's trust at some point.

djsumdog 10y ago

What if Dropbox has an exploit they're unaware of. Someone finds a whole in Dropbox and boom, now they have accessibility access. Even if you trust the software vendor, security concerns can cascade.

lucb1e 10y ago
This got downvoted and I'd like to know why. This was one of my first thoughts as well while reading the article: what if Dropbox gets hacked? Their client apparently has access to everything. What if the hack pushes a rogue client? Or one CDN endpoint serves a malicious update? Or a little bit of code is sneaked into the development process? Or an employee gets sour? Or a million other things that you hope never happen. There is a reason we don't run apache/nginx/any networked service as root. (You don't, right?)

__jal 10y ago

> and people get along perfectly fine and with less inconvenience shoved in their face running programs without permissions systems aside from a simple admin rights/no admin rights [...] ...For values of "perfectly fine" that include millions of malware slaves on the net, hundreds of millions of stolen passwords, targeted 0 days attacking human rights workers, file-encryptor extortion apps, etc. etc. etc. > What nefarious and yet undiscovered things If they're undiscovered, how am I supposed to list them? As far as discovered things, the permission allows Dropbox to sniff the keyboard and interact with any other application as the user. Add that to unrestricted filesystem access, and the right question to ask is what nefarious things Dropbox can't do.

skywhopper 10y ago

I prefer to know what the apps I install are going to be doing. To this end, OS-enforced permissions for using various services are a godsend. No program should need "admin" rights. And I should be able to know and control what each app I run can and cannot do. This seems utterly obvious to me. Even if most people dont' care, the tools should be there. There've been more than enough cases where apps have collected information they shouldn't have, whether intentionally or lazily. It baffles me that anyone could seriously make the argument you seem to be making.