4 ms·
Security culture, the Dropbox way
- java-man 8y agoa better approach would be implementing a zero-knowledge storage infrastructure, like tarsnap.
- mehrdada 8y agowhich prevents issues like https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
- pvg 8y agoThese sorts of hills grow to mountains with the bones of hopeful pedants who die on them. But I think there's still a chance to hold this one. That's not what 'zero knowledge' means, it's a technical term for a different thing.
- java-man 8y agoyou are technically correct (the best kind of correct). but it's a commonly understood concept: https://www.google.com/search?q=zero+knowledge+storage https://www.google.com/search?q=zero+knowledge+storage
- pvg 8y agoHold the line. This one we can still win. Hold the line. https://spideroak.com/articles/why-we-will-no-longer-use-the-phrase-zero-knowledge-to-describe-our-software/ https://spideroak.com/articles/why-we-will-no-longer-use-the...
- java-man 8y agoI surrender! End-to-end encrypted cloud storage with client- managed keys...
- myWindoonn 8y agoWe call this "provider-independent security" in capability theory; the idea is that a security guarantee, like privacy or confidentiality, is inherent in the construction regardless of who is providing the service.
- pvg 8y agoI'm sure Dropbox takes security seriously and works hard at it but this piece doesn't tell me a lot more than that except in much longer form. You can find/replace 'trust' (and 'security') with 'truck' and come away as informed and potentially slightly more amused.
- tlb 8y agoSome informative parts that keep their meaning under s/trust/truck/g include: "... daylong social engineering workshop designed and led by internal experts that immersed them in a hypothetical scenario involving a malicious insider." "... a hands-on workshop where Dropbox employees researched, crafted, and presented their own phishing schemes." "... our annual Capture the Flag" It's interesting the emphasis on social attacks. You only have to get the cryptography right once, but every employee needs to defend against social engineering.
- pvg 8y agoYou forgot the really important ones, I think. Trucktober and tailgating. It does raise the interesting question of why Dropbox does not celebrate Trarch.
- dokem 8y agoThe harder a company tries to sell their philosophy the less I'm inclined to believe them. Words are cheap.