11 ms·
Dropbox exposes personal details of viewers of publicly shared Paper documents
- WilliamEdward 7y agoDropBox doubled down. https://twitter.com/DropboxSupport/status/1176956611434352641 https://twitter.com/DropboxSupport/status/117695661143435264... https://twitter.com/DropboxSupport/status/1176956641293557770 https://twitter.com/DropboxSupport/status/117695664129355777... https://twitter.com/DropboxSupport/status/1176956671106658306 https://twitter.com/DropboxSupport/status/117695667110665830... (And they have no idea how twitter threads work)
- marksomnian 7y agoIt's probably their CS Twitter client that's coded without proper awareness of threads (likely only letting staff reply to the original message)
- troydavis 7y agoTo save folks a few clicks and in case those tweets are deleted, here's the content: > We understand the concerns, and want to assure you that privacy considerations are built into how we design our features. While Paper has a setting that allows anyone with the link to access a Paper doc, we warn users who try to access a doc owned by another team or a...[1/3] > ...user not on their team that their information will be visible in a screen that pops up before the Paper doc loads. Displaying this information is needed to enable collaboration and security features for our users. Users and admins can control who can view a Paper doc..[2/3] > ...in our settings. For more information see: https://help.dropbox.com/files-folders/paper/sharing-permissions https://help.dropbox.com/files-folders/paper/sharing-permiss... [3/3]
- raverbashing 7y agoThe threads are not working because DropboxSupport fumbled them in their answer You (I mean, the support account) need to make the following items a reply of the 1st item then it will work
- gdhbcc 7y agoThis looks like a GDPR breach. Does anyone know where i can find the details for the dropbox GDPR representative?
- daniel_iversen 7y agoWhy is it a GDPR breach when a Dropbox screen clearly explains to the user clicking the link that other users will see your details if you proceed? (Just curious, it may well be an issue, I just don’t know how).
- tasogare 7y agoI’m not expert in the matter but I’m sure just explaining some bad behavior does not make it legal if it were illegal.
- marcinzm 7y agoGDPR, as I understand, does not allow removing unrelated features if someone does not agree to have their privacy broken. For example, opting out of ad tracking cannot make the site be blocked for me. In this case, there is no opt out button other than not using the feature and the feature does not require this information sharing.
- dual_basis 7y agoEssentially Dropbox is arguing that, due to the way they have implemented it, the feature does require this information sharing. While it clearly could be implemented many different ways, and I agree Dropbox should do better in this case, I think this is one of the difficulties in enforcing something like GDPR. Almost anything could be made to work in an anonymous way, so where do you draw the line? When signing up for Facebook or an email account, for example, there is no reason they need my phone number. Sure, they say it is for password reset purposes, but there are other solutions for this, or I can simply agree not to be able to reset the password for that account... etc.
- 7y ago
- mlthoughts2018 7y agoI had a chance to join a machine learning team at Dropbox a few years ago. Ultimately what made me decline was this feeling that everyone in the office was sort of a zombie on autopilot. Nobody was excited about anything, all the use cases being kicked around for machine learning were extremely contrived recommendation and automation features that seemed like they had no real product research or stakeholder support to pursue them. It was like everyone was just resigned to raking in money on top of an extremely boring storage platform and clearly nobody was going to risk generous salary or equity coming in so they could rock the boat with an ambitious project. All to say it doesn’t surprise me that there was some lapse of quality checking or oversight on some feature of Paper integrating with Dropbox. The whole place reminded me of this quote by TS Eliot, “Oxford is very pretty, but I don’t like to be dead.”
- AznHisoka 7y agoDropbox to me seems like a one-trick pony trying desperately to expand their market. It's a cloud storage system. Ideally for consumers, not enterprises (who already have Google Drive, or AWS if you're storing web objects). I know they acquired HelloSign awhile back, but who the heck would want to use both DropBox and HelloSign together?
- mlthoughts2018 7y agoI believe their goal is to expand to enterprise customers who would use Dropbox as a replacement for something like Google Drive. They seem to hypothesize that the way to win market share is through collaboration intelligence features and coordination features. I think it’s a bad hypothesis and really if they have a way to win market share it’s purely by being a cheaper / more basic option, then maybe start-ups or small businesses would choose it. But this goes against the premium pricing and branding they have created for consumer storage plans, and I think hamstrings them from doing anything else really. And at the end of the day, if Google is worried you’re underpricing them, they have way more levers to pull on to retain or win back customers, and more cushion to absorb losses. Just seems like a bad business strategy by Dropbox all around. Probably should just focus on how to deliver consumer storage accounts with lower and lower prices instead.
- buboard 7y ago"seems problematic" - understatement of the month I always thought those indicators about who is viewing a publicly shared document were creepy
- gizmo 7y agoThis is completely reckless, but I'm not surprised. This is the company that pushed an update that allowed people to log on to any account with any password. Clearly they haven't learned anything about good security practices or responsible data governance.
- feketegy 7y agoIt's 2019 and devs still can't get this st right.
- iicc 7y ago> It's 2019 and devs still can't get this st right. It's 2019 and humans still make typos.
- jtbayly 7y agoOr it’s 2019 and Apple’s pro laptop keyboards still don’t work. ;)
- deleted 7y ago[deleted]
- danielhlockard 7y agoespecially on R, S, Space, and left-shift for me!
- fs111 7y agoIt is a feature. The devs worked to spec, it is PM who is to blame.
- neogodless 7y ago"For teams to work across the internet, they need to be able to see who else views the document on their team." "Got it, agreed." "What if they make it public, and the team is anyone on the internet?" "Same! Name, email, maybe more?!" No. No! If something is shared publicly, who views it should not be public knowledge. Or it should be screamed in blaring, blinking, marquee high-contrast banner across the screen to everyone before viewing the document.
- giancarlostoro 7y agoI'd be OK with just part of their email or something, or only first or last name (but never both, or switched). It should only be 1 bit of information that if it looks off it would alert someone that the link has been compromised. On the other hand I feel like Google Docs does the same thing.
- neogodless 7y agoI believe the way Google Docs works is that if you share something publicly, people show up as "Anonymous Animal" and that's about the limit of what you can learn about them, unless they are on the same G Suite account with you. Although I think you might have the option to "reveal your Google Account" to other users/viewers of the shared document.
- giancarlostoro 7y agoYeah that's what I meant, I've seen names on documents, didn't know the specifics of how they got there. All without logging on.
- johnisgood 7y ago> Although I think you might have the option to "reveal your Google Account" to other users/viewers of the shared document. Is it not the default when you are logged in? It used to be the case that when you are logged in and you visit Google Docs, you (your name at the very least) show up on the list of viewers.
- microcolonel 7y agoI mean, if they ask you... seems fine to me?
- plg 7y agoMan alive, all I want is a folder that syncs. That's all. I understand that Dropbox is a business and blah blah blah ... so what are my alternatives if I literally only want: - a folder that syncs on my devices - the ability to share a folder with others - cross-platform
- martin_a 7y agoMaybe something like a self-hosted NextCloud/OwnCloud? Although integration into the operating systems is not as good as with Dropbox, I completely switched to a self-hosted NextCloud and everything works fine without bloat.
- kop316 7y ago+1 on the Nextcloud. It hosts files great and completely replaced Dropbox. It also hosts my Contacts, Calendar, and with Collabra, it is a complete Google Docs replacement too. Like someone else said further down, it also does automatic picture uploads too.
- martin_a 7y agoAh, good to hear that. I still have to look into that to decouple more from Google. Do you have any good resources for more information on how to move contacts and calendar? Or did this work right from the start for you?
- kop316 7y agoIt was pretty out of the box friendly. You have to download all of that from google (I recall they have an export function), and it was in a file that nextcloud natively accepts.
- martin_a 7y agoAh, okay. I thought I would need to move them somehow right on my phone. Will have a look into that, thanks!
- marcinzm 7y agoI just created a Paper document on my Dropbox account and then viewed it on another account. As best I can tell, Dropbox saying there is a notification is a lie. I did not get a visible notification when creating it although there may have been one buried under some links or button. Paper documents are publicly editable by default if you have the url. I got no notification when viewing it from a different user. I used the public link to do so and could see the identities of other viewers.
- siproprio 7y agoThis should be great for finding active email addresses for spamming people. For example, there are a lot of hits for https://www.google.com/search?hl=en&q=%22https%3A%2F%2Fpaper.dropbox.com%2Fdoc%2F%22 And of course, by Guido van Rossum himself, there are quite a lot of emails here: view-source:https://paper.dropbox.com/doc/Yet-another-guided-tour-of-CPython--Alg6nzJCcNoY3S~SyY_T~KzuAg-XY7KgFGn88zMNivGJ4Jzv
- sbr464 7y agoIt definitely seems unnecessary to share the info to all users, especially full contact info. Airtable has a somewhat worse issue, any file you upload is publicly available without login, as long as you have the attachment URL. There isn’t any way to protect file assets, even though the underlying worksheet is private and requires a login.
- jostmey 7y agoAnd does anyone actually use Dropbox paper? I'd rather have a Dropbox email service and client than this silly product
- dual_basis 7y agoI do, because they are one of the few online collaboration platforms which support LaTeX. I'm not talking about Overleaf, which is great if you want to make a full LaTeX document, I'm talking about an easier markdown editor where LaTeX is only used for math equations. I don't need the full turing-completeness of LaTeX if I'm just taking some notes during a meeting, but I do want to be able to write math formulae and have them display correctly. This was the sole reason I checked it out, however I have grown to appreciate many of their other features. Their collaboration functionality is quite unique, and the generally smooth way you can add structured information (eg. "todos" with assigned users and due dates) is great. That being said, it often feels "half-baked" still compared to other solutions. The Paper file organization interface feels like it is just bolted on top of Dropbox's existing interface, and sometimes their formatting is too restrictive (eg. you can't change text alignment). The issue raised in this post is yet another example of the product being half-baked.
- bobbylarrybobby 7y agoYou should look into Notion.so. They don’t have inline TeX (yet?) but they do have block TeX.
- dual_basis 7y agoThanks, Notion looks pretty great. Beats Dropbox Paper on almost all fronts except the inline TeX. It looks like it is on their radar: https://twitter.com/NotionHQ/status/1093334827770699778 https://twitter.com/NotionHQ/status/1093334827770699778 In the meantime, there is this workaround: https://www.notion.so/Notion-Inline-Math-9c5047a4e7c84643848b3630db8d5a5e https://www.notion.so/Notion-Inline-Math-9c5047a4e7c84643848... It's not a great workaround, however, since (by the way it works) it looks like it would only work locally on the user's browser assuming they install the violentmonkey browser extension, it is rather verbose (the code block + `math:` prefix), and having to press F2 to rerender all inline math.
- jcsnv 7y agoI use two Chrome profile, one for work and one for personal. I keep them separate by not logging into personal account in with the work profile etc. Whenever I open Dropbox Paper with my work Chrome profile, it shows to have access to my personal Dropbox. These two are separate Dropbox accounts with separate emails associated to them. Yet, I'm able to access them since I sync a shared folder from my personal account on the same computer as the work Dropbox account (Work Dropbox account being the account thats logged into on the computer). Seems like UX overtook security in this aspect since I didn't explicitly want to "connect" both accounts outside of shared folder.
- deleted 7y ago[deleted]
- peterkelly 7y agoNot only that, but Dropbox lets you pick any publicly visible document that's been viewed by a large number of people and easily spam them simply by writing @doc. I may have just pissed off a lot of people with my experiment :( I realised immediately afterwards how reckless that was, but Dropbox - WTF? Why is this even allowed?
- dbrgn 7y agoI was spammed by you. I first thought you're an idiot, but this is fine ;) Pinging all viewers of a public document with a message should not be possible.
- justryry 7y agoThanks for the spam!
- ratsmack 7y agoSometimes there will be a little pain associated with creating more awareness to issues like this... you did the right thing.
- nevi-me 7y agoThanks for this, I forgive you for this; hope Dropbox fixes this soon enough. I went a while being followed by spam after a Dropbox email leak a few years ago
- tempsy 7y agoI think the first self-described "growth hacker" worked for Dropbox way back when. Would not be surprised that the toxic "growth hacking" ethos still permeates through their growth/product teams today.
- ooooak 7y ago> I may have just pissed off a lot of people with my experiment :( That's why we don't test on production
- deiga 7y agoYou did the right thing! This is seriously WTF! And I'm not entirely sure if this isn't even a breach of GDPR in the EU :scream:
- sambe 7y agoIt feels like there are more responsible ways to deal with this than showing up their support team on Twitter.
- honest_tovarich 7y agoI guess Dropbox violates user’s privacy in a multi-threaded fashion. ;-)
- FanaHOVA 7y agoNot a great response either: https://twitter.com/DropboxSupport/status/1176956611434352641 https://twitter.com/DropboxSupport/status/117695661143435264...