6 ms·
I suppose when you're not able to give an unwavering commitment to protecting your customers data, coming up with a completely unrelated corporate social respon
by pentae 9y ago
I suppose when you're not able to give an unwavering commitment to protecting your customers data, coming up with a completely unrelated corporate social responsibility plan like this makes sense.
- godzillabrennus 9y agoThis. It's amazing how many big companies use Dropbox with how limited their commitment to protecting customer data has been.
- digi_owl 9y agoI suspect that corporations have much more leverage in this than consumers...
- littlestymaar 9y agoFor US corps maybe, but many foreign companies also use dropbox even though they have little to no leverage in the US.
- idrios 9y agoClarification needed. When you say their commitment has been limited, do you mean they have done things that go contrary to protecting data (like selling user data to ad companies, or handing user data to government agencies when requested) or that they haven't actively taken a stance for protecting customer data (such as duckduckgo's promise not to track you, or Wikipedia's promise to stay donation-based).
- laurent123456 9y agoIn which way is Dropbox data not protected? Do you mean they tend to lose files?
- older 9y agoDropbox doesn't encrypt your data. Compare them [1] and SpiderOak [2] for example. [1] https://www.dropbox.com/security https://www.dropbox.com/security [2] https://spideroak.com/no-knowledge/ https://spideroak.com/no-knowledge/
- daniel_iversen 9y agoYes Dropbox encrypts your data. It even says so on the Dropbox page you linked to :-)
- SyneRyder 9y agoBut encrypted in a way where Dropbox employees still have unencrypted access to your files, at least according to Christopher Soghoian back in 2011: https://www.theregister.co.uk/2011/05/16/dropbox_ftc_not_good_enough/ https://www.theregister.co.uk/2011/05/16/dropbox_ftc_not_goo...
- acdha 9y agoThat’s a different claim and one with severe tradeoffs for the other option: you can regain access to your Dropbox after losing your password. Since you’re running their software, you’re ultimately trusting their policies anyway. Even if they had encryption at rest it wouldn’t tell you that it’s correctly implemented and doesn’t e.g. leak keys.
- chinathrow 9y agoThey do - but they hold all keys themselves.
- wkillerud 9y agoThey encrypt in transit, but not data at rest by the looks of things. At least I don't get that impression.
- MrCoates 9y agoPer your link, Dropbox states only metadata isn't encrypted. "The actual contents of users’ files are stored in encrypted blocks with this service. Each individual encrypted file block is retrieved based on its hash value, and an additional layer of encryption is provided for all file blocks at rest using a strong cipher."
- tgb 9y agoWhat exactly are you referring to? My life is stored on Dropbox so I'd rather like to know.
- anubisresources 9y agoDropbox doesn’t encrypt your data. There area bunch of other companies that do encrypted cloud storage, eg keybase
- daniel_iversen 9y agoYes it does, see https://www.dropbox.com/security https://www.dropbox.com/security
- progval 9y agoDecryption keys are stored on Dropbox's servers, which makes this encryption pointless if the company turns evil.
- dsacco 9y agoNot all decryption needs to be end to end encryption. I’m not sure when this idea developed, but it’s silly. If your threat model mandates that you use end to end encryption, go for it, and choose something other than Dropbox. But saying the encryption is pointless just because the organization that manages the keys could become “evil” is hyperbole.
- josh2600 9y agoDropbox deduplicates files across user accounts to minimize storage. Effectively, this means all accounts share one private key for encryption... Edit: to be clear, I believe it is an option on enterprise accounts to use your own key.
- dsacco 9y agoThis shouldn’t be downvoted. The page states clearly that data is encrypted both in transit and at rest.