4 ms·
It's very clear from that page that the data is sometimes transmitted unencrypted. It's also clear that if it's encrypted server-side it's encrypted with a key
by new299 10y ago
It's very clear from that page that the data is sometimes transmitted unencrypted.
It's also clear that if it's encrypted server-side it's encrypted with a key known to dropbox (which in my opinion makes the encryption meaningless).
So, technically it's possible that my statement was slightly misleading. It may be encrypted.
But the conclusion is, they have access to all your data. It would be available under warrentless surveillance programs, or potentially to attackers in general.
That doesn't seem acceptable to me.
- petters 10y agoYeah, I think it would be too expensive for Dropbox to truly encrypt the data. Because then decuplication would not be possible.
- new299 10y agoIt would certainly be interesting to know how much space is saved through deduplication. However, my guess is that it's very unlikely to make the difference between a viable and a non-viable company. Particularly as they had a viable business when storing data on S3 [1]. I'd expect the cost savings of moving from S3 to their own hosted storage to be far greater than those earned through deduplication. [1] https://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud-empire/ https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
- runako 10y ago> they have access to all your data Curious: how would one design a service like Dropbox with Web + mobile + desktop clients such that the service operator could not access the data? (This is a mass-market service, so I mean without requiring Web users to install certificates, etc.) What design changes would you suggest they make?