4 ms·

> they've made no moves to encrypt data service side From their website[0]: "Dropbox file data is stored in discrete file blocks that are fragmented and encryp

> they've made no moves to encrypt data service side From their website[0]: "Dropbox file data is stored in discrete file blocks that are fragmented and encrypted using 256-bit AES." [0] https://www.dropbox.com/security https://www.dropbox.com/security

new299 10y ago
It's very clear from that page that the data is sometimes transmitted unencrypted. It's also clear that if it's encrypted server-side it's encrypted with a key known to dropbox (which in my opinion makes the encryption meaningless). So, technically it's possible that my statement was slightly misleading. It may be encrypted. But the conclusion is, they have access to all your data. It would be available under warrentless surveillance programs, or potentially to attackers in general. That doesn't seem acceptable to me.
- petters 10y ago
  Yeah, I think it would be too expensive for Dropbox to truly encrypt the data. Because then decuplication would not be possible.
  - new299 10y ago
    It would certainly be interesting to know how much space is saved through deduplication. However, my guess is that it's very unlikely to make the difference between a viable and a non-viable company. Particularly as they had a viable business when storing data on S3 [1]. I'd expect the cost savings of moving from S3 to their own hosted storage to be far greater than those earned through deduplication. [1] https://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud-empire/ https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
- runako 10y ago
  > they have access to all your data Curious: how would one design a service like Dropbox with Web + mobile + desktop clients such that the service operator could not access the data? (This is a mass-market service, so I mean without requiring Web users to install certificates, etc.) What design changes would you suggest they make?

new299 10y ago

It's very clear from that page that the data is sometimes transmitted unencrypted. It's also clear that if it's encrypted server-side it's encrypted with a key known to dropbox (which in my opinion makes the encryption meaningless). So, technically it's possible that my statement was slightly misleading. It may be encrypted. But the conclusion is, they have access to all your data. It would be available under warrentless surveillance programs, or potentially to attackers in general. That doesn't seem acceptable to me.

petters 10y ago
Yeah, I think it would be too expensive for Dropbox to truly encrypt the data. Because then decuplication would not be possible.
- new299 10y ago
  It would certainly be interesting to know how much space is saved through deduplication. However, my guess is that it's very unlikely to make the difference between a viable and a non-viable company. Particularly as they had a viable business when storing data on S3 [1]. I'd expect the cost savings of moving from S3 to their own hosted storage to be far greater than those earned through deduplication. [1] https://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud-empire/ https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
runako 10y ago
> they have access to all your data Curious: how would one design a service like Dropbox with Web + mobile + desktop clients such that the service operator could not access the data? (This is a mass-market service, so I mean without requiring Web users to install certificates, etc.) What design changes would you suggest they make?