2 ms·

Adding secure client side encryption would quite much limit any new services they could add. No indexing on server side, no web based document editing. Deduplic

Adding secure client side encryption would quite much limit any new services they could add. No indexing on server side, no web based document editing. Deduplication would become either impossible or much more difficult. This might also cause problems on the user experience side, for example password resets would not work - if you forget password, data is gone for ever. Organizational accounts and file sharing would be harder to implement. In order to really prevent snooping, they would also have to take away the pretty well working auto update system (otherwise they could just push an update that sends your password to them). I think this is just a business decision. Dropbox does not want to be the simple bit-pipe that is used to sync stuff between your computers. They want to provide more advanced services, because they believe that is where the money is.

new299 10y ago
I would agree that I think this is mostly a business decision. And it seems to be the same business decision that almost every player in this space has made. But it relies on the user trusting the vendor with their data. The user can't audit Dropboxes internal systems. They can't rely on the fact that security researchers will audit the client, and ensure that data is transmitted securely. So it comes down to trust. I can't really see how I can trust dropbox when they think having board members who advocate warrantless surveillance is reasonable. They chose a board member who is in favor of providing their users data, without the need for a warrant. In contrast, Apple have made a stand against government access to their users data outside of legal requirements. Their service has similar issues, but I'd be more likely to place my trust in Apple than Dropbox because they have some track record of fighting back. Ideally, what I'd like to see is optional client-side encryption that was externally audited. Unfortunately I think it's a feature that most users don't see as critical.

new299 10y ago

I would agree that I think this is mostly a business decision. And it seems to be the same business decision that almost every player in this space has made. But it relies on the user trusting the vendor with their data. The user can't audit Dropboxes internal systems. They can't rely on the fact that security researchers will audit the client, and ensure that data is transmitted securely. So it comes down to trust. I can't really see how I can trust dropbox when they think having board members who advocate warrantless surveillance is reasonable. They chose a board member who is in favor of providing their users data, without the need for a warrant. In contrast, Apple have made a stand against government access to their users data outside of legal requirements. Their service has similar issues, but I'd be more likely to place my trust in Apple than Dropbox because they have some track record of fighting back. Ideally, what I'd like to see is optional client-side encryption that was externally audited. Unfortunately I think it's a feature that most users don't see as critical.