4 ms·

Although the website mentions that "files are encrypted to military-grade standards" that doesn't help if secure client-side encryption is missing. The best en

by gst 16y ago

Although the website mentions that "files are encrypted to military-grade standards" that doesn't help if secure client-side encryption is missing. The best encryption doesn't help (me as a user) if I'm not the one in control of it. And even if I would fully trust Dropbox this does not help, as Dropbox must still surrender the data if, e.g., requested by law enforcement (which would not be an issue if the data were encrypted on the client, so that the user is the only one able to decrypt it). Using software like encfs inside a Dropbox container does not help either. Once I start hacking around on such solutions it's easier to just use a service with client-side encryption. So if anyone from Dropbox is reading this: Consider this as a "feature request". I absolutely love the way how Dropbox works, but right now I don't really use it due to this security issue.

DrJokepu 16y ago
Most modern operating systems support file system encryption out of the box. Why can't you just use that?
- StavrosK 16y ago
  Because Dropbox still have your data unencrypted.
  - DrJokepu 16y ago
    But he was talking about client-side encryption, wasn't he? That's what I infer from the first line.
    - gst 16y ago
      I meant client-side encryption of data before it is submitted to the server.
edanm 16y ago
Honest question - what are you worried might happen? From your comment, it seems like you do trust Dropbox but are afraid they might have to surrender your data, but I can't imagine what kind of data you have that might be that sensitive.
- StavrosK 16y ago
  It's not a matter of data being sensitive, it's a matter of paranoia and data control. I do it too, I don't like my data leaving my control, which is why I use SpiderOak even though it's much more of a hassle sometimes.
kanak 16y ago
I agree fully. The only thing this is doing is ensuring that the data cannot be seen by someone in transit; as long as you're not using your own key, anyone dropbox still has access to your data. I remember this issue being raised earlier, as I recall, tarsnap and spideroak were the suggested alternatives.
ams6110 16y ago
You are talking about a team of people here, so your data are already out of your control. I think you have more to fear from someone on the team going rogue or being compromised than from Dropbox disclosing your data to a 3rd party.

by gst 16y ago

DrJokepu 16y ago

Most modern operating systems support file system encryption out of the box. Why can't you just use that?

StavrosK 16y ago
Because Dropbox still have your data unencrypted.
- DrJokepu 16y ago
  But he was talking about client-side encryption, wasn't he? That's what I infer from the first line.
  - gst 16y ago
    I meant client-side encryption of data before it is submitted to the server.

edanm 16y ago

Honest question - what are you worried might happen? From your comment, it seems like you do trust Dropbox but are afraid they might have to surrender your data, but I can't imagine what kind of data you have that might be that sensitive.

StavrosK 16y ago
It's not a matter of data being sensitive, it's a matter of paranoia and data control. I do it too, I don't like my data leaving my control, which is why I use SpiderOak even though it's much more of a hassle sometimes.

kanak 16y ago

I agree fully. The only thing this is doing is ensuring that the data cannot be seen by someone in transit; as long as you're not using your own key, anyone dropbox still has access to your data. I remember this issue being raised earlier, as I recall, tarsnap and spideroak were the suggested alternatives.

ams6110 16y ago

You are talking about a team of people here, so your data are already out of your control. I think you have more to fear from someone on the team going rogue or being compromised than from Dropbox disclosing your data to a 3rd party.