5 ms·

I'm slightly shocked that tech-types who in general seem to be against mass state sponsored surveillance continue to support Dropbox. Dropbox appointed Condolee

by new299 10y ago

I'm slightly shocked that tech-types who in general seem to be against mass state sponsored surveillance continue to support Dropbox. Dropbox appointed Condoleezza Rice to their board. Rice supports warrentless surveillance [1]. They've made no moves to encrypt data service side. I hope their IPO fails spectacularly so that support of warrentless surveillance does not become the norm in tech companies. [1] Condoleezza Rice (http://www.drop-dropbox.com/ http://www.drop-dropbox.com/)

edanm 10y ago
I think most people recognize that they don't necessarily agree with everyone, especially when it comes to politics, and that refusing to work with people because you dislike their politics is, in general, not a smart thing to do. Not to mention not supporting companies because one of their board members takes a position you dislike on an issue.
- drewrv 10y ago
  I'm happy to work with people whom I disagree with politically. But if you're concerned about privacy, giving all your files unencrypted to a company that is uninterested in your privacy (as demonstrated by their board) is just bonkers.
- new299 10y ago
  In generally, absolutely. But it's quite clear that Rice's value to Dropbox is based around her background in politics. And in particular, her background in politics is one that is diametrically opposed to what Dropbox should be providing its users. A secure, private storage service.
- gurkendoktor 10y ago
  There is a difference between disagreeing with positions and judging past actions. Rice didn't have fringe opinions that she occasionally ranted about on Facebook. The stuff on drop-dropbox.com was her full-time job, her life's work. > refusing to work with people because you dislike their politics is, in general, not a smart thing to do Like vaccinations, it can be effective when most people do it. I think (hope) many companies would have declined the chance to work with her.
ternaryoperator 10y ago
> they've made no moves to encrypt data service side From their website[0]: "Dropbox file data is stored in discrete file blocks that are fragmented and encrypted using 256-bit AES." [0] https://www.dropbox.com/security https://www.dropbox.com/security
- new299 10y ago
  It's very clear from that page that the data is sometimes transmitted unencrypted. It's also clear that if it's encrypted server-side it's encrypted with a key known to dropbox (which in my opinion makes the encryption meaningless). So, technically it's possible that my statement was slightly misleading. It may be encrypted. But the conclusion is, they have access to all your data. It would be available under warrentless surveillance programs, or potentially to attackers in general. That doesn't seem acceptable to me.
  - petters 10y ago
    Yeah, I think it would be too expensive for Dropbox to truly encrypt the data. Because then decuplication would not be possible.
    - new299 10y ago
      It would certainly be interesting to know how much space is saved through deduplication. However, my guess is that it's very unlikely to make the difference between a viable and a non-viable company. Particularly as they had a viable business when storing data on S3 [1]. I'd expect the cost savings of moving from S3 to their own hosted storage to be far greater than those earned through deduplication. [1] https://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud-empire/ https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
  - runako 10y ago
    > they have access to all your data Curious: how would one design a service like Dropbox with Web + mobile + desktop clients such that the service operator could not access the data? (This is a mass-market service, so I mean without requiring Web users to install certificates, etc.) What design changes would you suggest they make?
zeveb 10y ago
> Rice supports warrentless surveillance. Warrants are only required in some cases of surveillance. Those who are not U.S. persons do not have a constitutional right to a warrant before being surveilled. Public information does not require a warrant (e.g. the government does not require a warrant to open a phone book). Third parties may volunteer information without a warrant. Items crossing a national border — including communications crossing a national border — do not require a warrant. There are plenty of constitutional, legal warrantless searches. You may not like some or all of those; I may not like some of those. But neither you nor I are the dictator of the Constitution or the law.
jpalomaki 10y ago
Adding secure client side encryption would quite much limit any new services they could add. No indexing on server side, no web based document editing. Deduplication would become either impossible or much more difficult. This might also cause problems on the user experience side, for example password resets would not work - if you forget password, data is gone for ever. Organizational accounts and file sharing would be harder to implement. In order to really prevent snooping, they would also have to take away the pretty well working auto update system (otherwise they could just push an update that sends your password to them). I think this is just a business decision. Dropbox does not want to be the simple bit-pipe that is used to sync stuff between your computers. They want to provide more advanced services, because they believe that is where the money is.
- new299 10y ago
  I would agree that I think this is mostly a business decision. And it seems to be the same business decision that almost every player in this space has made. But it relies on the user trusting the vendor with their data. The user can't audit Dropboxes internal systems. They can't rely on the fact that security researchers will audit the client, and ensure that data is transmitted securely. So it comes down to trust. I can't really see how I can trust dropbox when they think having board members who advocate warrantless surveillance is reasonable. They chose a board member who is in favor of providing their users data, without the need for a warrant. In contrast, Apple have made a stand against government access to their users data outside of legal requirements. Their service has similar issues, but I'd be more likely to place my trust in Apple than Dropbox because they have some track record of fighting back. Ideally, what I'd like to see is optional client-side encryption that was externally audited. Unfortunately I think it's a feature that most users don't see as critical.

by new299 10y ago

edanm 10y ago

I think most people recognize that they don't necessarily agree with everyone, especially when it comes to politics, and that refusing to work with people because you dislike their politics is, in general, not a smart thing to do. Not to mention not supporting companies because one of their board members takes a position you dislike on an issue.

drewrv 10y ago
I'm happy to work with people whom I disagree with politically. But if you're concerned about privacy, giving all your files unencrypted to a company that is uninterested in your privacy (as demonstrated by their board) is just bonkers.
new299 10y ago
In generally, absolutely. But it's quite clear that Rice's value to Dropbox is based around her background in politics. And in particular, her background in politics is one that is diametrically opposed to what Dropbox should be providing its users. A secure, private storage service.
gurkendoktor 10y ago
There is a difference between disagreeing with positions and judging past actions. Rice didn't have fringe opinions that she occasionally ranted about on Facebook. The stuff on drop-dropbox.com was her full-time job, her life's work. > refusing to work with people because you dislike their politics is, in general, not a smart thing to do Like vaccinations, it can be effective when most people do it. I think (hope) many companies would have declined the chance to work with her.

ternaryoperator 10y ago

> they've made no moves to encrypt data service side From their website[0]: "Dropbox file data is stored in discrete file blocks that are fragmented and encrypted using 256-bit AES." [0] https://www.dropbox.com/security https://www.dropbox.com/security

new299 10y ago
It's very clear from that page that the data is sometimes transmitted unencrypted. It's also clear that if it's encrypted server-side it's encrypted with a key known to dropbox (which in my opinion makes the encryption meaningless). So, technically it's possible that my statement was slightly misleading. It may be encrypted. But the conclusion is, they have access to all your data. It would be available under warrentless surveillance programs, or potentially to attackers in general. That doesn't seem acceptable to me.
- petters 10y ago
  Yeah, I think it would be too expensive for Dropbox to truly encrypt the data. Because then decuplication would not be possible.
  - new299 10y ago
    It would certainly be interesting to know how much space is saved through deduplication. However, my guess is that it's very unlikely to make the difference between a viable and a non-viable company. Particularly as they had a viable business when storing data on S3 [1]. I'd expect the cost savings of moving from S3 to their own hosted storage to be far greater than those earned through deduplication. [1] https://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud-empire/ https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
- runako 10y ago
  > they have access to all your data Curious: how would one design a service like Dropbox with Web + mobile + desktop clients such that the service operator could not access the data? (This is a mass-market service, so I mean without requiring Web users to install certificates, etc.) What design changes would you suggest they make?

zeveb 10y ago

> Rice supports warrentless surveillance. Warrants are only required in some cases of surveillance. Those who are not U.S. persons do not have a constitutional right to a warrant before being surveilled. Public information does not require a warrant (e.g. the government does not require a warrant to open a phone book). Third parties may volunteer information without a warrant. Items crossing a national border — including communications crossing a national border — do not require a warrant. There are plenty of constitutional, legal warrantless searches. You may not like some or all of those; I may not like some of those. But neither you nor I are the dictator of the Constitution or the law.

jpalomaki 10y ago

Adding secure client side encryption would quite much limit any new services they could add. No indexing on server side, no web based document editing. Deduplication would become either impossible or much more difficult. This might also cause problems on the user experience side, for example password resets would not work - if you forget password, data is gone for ever. Organizational accounts and file sharing would be harder to implement. In order to really prevent snooping, they would also have to take away the pretty well working auto update system (otherwise they could just push an update that sends your password to them). I think this is just a business decision. Dropbox does not want to be the simple bit-pipe that is used to sync stuff between your computers. They want to provide more advanced services, because they believe that is where the money is.

new299 10y ago
I would agree that I think this is mostly a business decision. And it seems to be the same business decision that almost every player in this space has made. But it relies on the user trusting the vendor with their data. The user can't audit Dropboxes internal systems. They can't rely on the fact that security researchers will audit the client, and ensure that data is transmitted securely. So it comes down to trust. I can't really see how I can trust dropbox when they think having board members who advocate warrantless surveillance is reasonable. They chose a board member who is in favor of providing their users data, without the need for a warrant. In contrast, Apple have made a stand against government access to their users data outside of legal requirements. Their service has similar issues, but I'd be more likely to place my trust in Apple than Dropbox because they have some track record of fighting back. Ideally, what I'd like to see is optional client-side encryption that was externally audited. Unfortunately I think it's a feature that most users don't see as critical.