5 ms·

Well, it's a stored authentication token mechanism, which is the same as is used by many other client-side software. However, there are two possible ways to imp

by mryall 16y ago

Well, it's a stored authentication token mechanism, which is the same as is used by many other client-side software. However, there are two possible ways to improve the authentication: - use a second factor in the authentication, such as the MAC address of the primary NIC in the machine - limit the time that the token is valid by getting the client to periodically get a new token from the server. This prevents two clients using the same token indefinitely without detection. Both these would be good improvements to the security of the host_id data that Dropbox uses for authentication.

tptacek 16y ago
A system can easily be set up to lie about its MAC address, and you can't hide the legitimate MAC address. It's a very bad secret value. The only thing you can do, without entering the reverse engineering arms race, is to add a real second-factor key to the equation --- meaning, something a user has to remember or read off a fob. And in fact, only the fob helps you here, since malware can (and does, every day, in bank fraud trojans) capture any secret you enter. I agree that it would be better for security if Dropbox made rekeying happen more, but they can do the cost-benefit better than I can here.
- Dylan16807 16y ago
  In addition to MAC address use adding no real security it would get in the way of running Dropbox on a flash drive, which works even if not ideally.
  - bigiain 16y ago
    Keep in mind here "not ideally" includes "you lose your flashdrive, then whoever finds it has full and ongoing access to your Dropbox account". That's kind of a worry.
    - limmeau 16y ago
      Ongoing? I can still use the website to delete the host whose host ID is on the flash drive.
      - bigiain 16y ago
        So long as you realised... From FTA: "Taking the config.db file, copying it onto another system (you may need to modify the dropbox_path, to a valid path), and then starting the Dropbox client immediately joins that system into the synchronization group without notifying the authorized user, prompting for credentials, or even getting added to the list of linked devices within your Dropbox account (even though the new system has a completely different name) – this appears to be by design."
        limmeau 16y ago
        Of course I assume that I eventually notice the theft of a USB stick on which I put enough information for Dropbox to sync my entire tree. Does the article say that I can't revoke a machine's access via the web interface once the config.db for that machine has been copied?
- seanalltogether 16y ago
  Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate. When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt. Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.
  - tptacek 16y ago
    This works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.
    - seanalltogether 16y ago
      Banks absolutely do this once they have the ability to talk to the OS. I've built 3 banking apps for iphone/ipad now and client side verification was involved in all of them after first login. The problem is browsers just don't have a good standard way of accomplishing this.
    - mason55 16y ago
      All my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)
      - tptacek 16y ago
        I think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.
        16y ago
- zwp 16y ago
  > The only thing you can do [...] Or you could build a trusted end point. Otherwise even two factor auth is only palliative. (But yes: cost-benefit, I hear you). http://www.businesscomputingworld.co.uk/two-factor-authentication-powerless-against-real-time-phishing-attacks/ http://www.businesscomputingworld.co.uk/two-factor-authentic...
- deleted 16y ago
  [deleted]
- mryall 16y ago
  Yes, systems can definitely fake any ID you attempt to use: MAC addresses, machine IDs, hostnames, etc. Attackers can intercept rekey attempts and clone the new key on their systems. But arguing that these improvements shouldn't be done because they don't totally close every security vulnerability in a system is an example of Perfect Solution fallacy [1]. Just because security cannot be perfect doesn't mean that steps to improve it shouldn't be taken. The advantage of rekeying or secondary verification of the client is that it addresses the kind of attack where you can simply copy this metadata and have enough information to remotely compromise the Dropbox data later. As you say, whether that is worth fixing is up to Dropbox to do a cost-benefit analysis. But I hope they wouldn't discard the chance to improve their security simply because a perfectly secure system isn't possible. [1] http://en.wikipedia.org/wiki/Nirvana_fallacy#Perfect_Solution_Fallacy http://en.wikipedia.org/wiki/Nirvana_fallacy#Perfect_Solutio...
pornel 16y ago
They could make the token derived from user's password (e.g. Hash(host_id + Hash(password))), so when password changes, all existing tokens are invalidated.
- tptacek 16y ago
  We haven't looked at Dropbox professionally; if tokens are valid after password changes, we'd flag that. I'm don't know enough about Dropbox to say whether they do or don't. (I have Dropbox on my personal machine but not my work machine).
  - JoachimSchipper 16y ago
    The article says that changing passwords doesn't help: "Additionally, the host_id is still valid even after the user changes their Dropbox password (thus a standard remediation step of changing credentials does not resolve this issue)."
- drdaeman 16y ago
  So, if my password is compromised (or I just routinely change it after some self-defined "expiry date"), I have to visit all my devices and reauthenticate them? I believe this is counter-intuitive and inconvenient. If some of my devices (tokens) are compromised, I'd just go to Dropbox web interface and revoke their tokens.
  - tptacek 16y ago
    Normal people assume that if their account is compromised, the appropriate countermeasure is to change their password and get on with your life. Is Dropbox a tool for normal people or for people who geek out on device authentication?
    - drdaeman 16y ago
      So, in proposed scheme, they change the password and everything goes out of sync. The proper and perfectly intuitive way is to not think what users'll assume. Just add a checkbox "also, unlink all my devices" on the very password change page.
arethuza 16y ago
Another, rather extreme, option would be to support hardware security devices that can store PKI private keys and perform asymmetric encryption within the device (i.e. there is no way to read the private key) e.g. http://www.safenet-inc.com/products/data-protection/two-factor-authentication/ikey-usb-232/ http://www.safenet-inc.com/products/data-protection/two-fact... This would provide a pretty good additional "something you have" authentication factor.
- zwp 16y ago
  Whilst the system software is vulnerable this doesn't gain a lot (you're in Thomas' arms race): malware intercepts the transaction request and requests "please scan your fingerprint to sign transaction of $1"... then quietly presents a $1000 charge to be signed by the PKI token. Even TPM can't help if the software is hacked.
m_eiman 16y ago
An easier way to detect something fishy would be to allow at most one connection per auth token, and invalidate it and re-request login credentials if a collision occurs. Just ping both connections first to make sure they're both actually alive, and not the same machine logging in again after a reboot-after-crash.

by mryall 16y ago

tptacek 16y ago

A system can easily be set up to lie about its MAC address, and you can't hide the legitimate MAC address. It's a very bad secret value. The only thing you can do, without entering the reverse engineering arms race, is to add a real second-factor key to the equation --- meaning, something a user has to remember or read off a fob. And in fact, only the fob helps you here, since malware can (and does, every day, in bank fraud trojans) capture any secret you enter. I agree that it would be better for security if Dropbox made rekeying happen more, but they can do the cost-benefit better than I can here.

Dylan16807 16y ago
In addition to MAC address use adding no real security it would get in the way of running Dropbox on a flash drive, which works even if not ideally.
- bigiain 16y ago
  Keep in mind here "not ideally" includes "you lose your flashdrive, then whoever finds it has full and ongoing access to your Dropbox account". That's kind of a worry.
  - limmeau 16y ago
    Ongoing? I can still use the website to delete the host whose host ID is on the flash drive.
    - bigiain 16y ago
      So long as you realised... From FTA: "Taking the config.db file, copying it onto another system (you may need to modify the dropbox_path, to a valid path), and then starting the Dropbox client immediately joins that system into the synchronization group without notifying the authorized user, prompting for credentials, or even getting added to the list of linked devices within your Dropbox account (even though the new system has a completely different name) – this appears to be by design."
      - limmeau 16y ago
        Of course I assume that I eventually notice the theft of a USB stick on which I put enough information for Dropbox to sync my entire tree. Does the article say that I can't revoke a machine's access via the web interface once the config.db for that machine has been copied?
seanalltogether 16y ago
Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate. When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt. Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.
- tptacek 16y ago
  This works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.
  - seanalltogether 16y ago
    Banks absolutely do this once they have the ability to talk to the OS. I've built 3 banking apps for iphone/ipad now and client side verification was involved in all of them after first login. The problem is browsers just don't have a good standard way of accomplishing this.
  - mason55 16y ago
    All my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)
    - tptacek 16y ago
      I think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.
      - 16y ago
zwp 16y ago
> The only thing you can do [...] Or you could build a trusted end point. Otherwise even two factor auth is only palliative. (But yes: cost-benefit, I hear you). http://www.businesscomputingworld.co.uk/two-factor-authentication-powerless-against-real-time-phishing-attacks/ http://www.businesscomputingworld.co.uk/two-factor-authentic...
deleted 16y ago
[deleted]
mryall 16y ago
Yes, systems can definitely fake any ID you attempt to use: MAC addresses, machine IDs, hostnames, etc. Attackers can intercept rekey attempts and clone the new key on their systems. But arguing that these improvements shouldn't be done because they don't totally close every security vulnerability in a system is an example of Perfect Solution fallacy [1]. Just because security cannot be perfect doesn't mean that steps to improve it shouldn't be taken. The advantage of rekeying or secondary verification of the client is that it addresses the kind of attack where you can simply copy this metadata and have enough information to remotely compromise the Dropbox data later. As you say, whether that is worth fixing is up to Dropbox to do a cost-benefit analysis. But I hope they wouldn't discard the chance to improve their security simply because a perfectly secure system isn't possible. [1] http://en.wikipedia.org/wiki/Nirvana_fallacy#Perfect_Solution_Fallacy http://en.wikipedia.org/wiki/Nirvana_fallacy#Perfect_Solutio...

pornel 16y ago

They could make the token derived from user's password (e.g. Hash(host_id + Hash(password))), so when password changes, all existing tokens are invalidated.

tptacek 16y ago
We haven't looked at Dropbox professionally; if tokens are valid after password changes, we'd flag that. I'm don't know enough about Dropbox to say whether they do or don't. (I have Dropbox on my personal machine but not my work machine).
- JoachimSchipper 16y ago
  The article says that changing passwords doesn't help: "Additionally, the host_id is still valid even after the user changes their Dropbox password (thus a standard remediation step of changing credentials does not resolve this issue)."
drdaeman 16y ago
So, if my password is compromised (or I just routinely change it after some self-defined "expiry date"), I have to visit all my devices and reauthenticate them? I believe this is counter-intuitive and inconvenient. If some of my devices (tokens) are compromised, I'd just go to Dropbox web interface and revoke their tokens.
- tptacek 16y ago
  Normal people assume that if their account is compromised, the appropriate countermeasure is to change their password and get on with your life. Is Dropbox a tool for normal people or for people who geek out on device authentication?
  - drdaeman 16y ago
    So, in proposed scheme, they change the password and everything goes out of sync. The proper and perfectly intuitive way is to not think what users'll assume. Just add a checkbox "also, unlink all my devices" on the very password change page.

arethuza 16y ago

Another, rather extreme, option would be to support hardware security devices that can store PKI private keys and perform asymmetric encryption within the device (i.e. there is no way to read the private key) e.g. http://www.safenet-inc.com/products/data-protection/two-factor-authentication/ikey-usb-232/ http://www.safenet-inc.com/products/data-protection/two-fact... This would provide a pretty good additional "something you have" authentication factor.

zwp 16y ago
Whilst the system software is vulnerable this doesn't gain a lot (you're in Thomas' arms race): malware intercepts the transaction request and requests "please scan your fingerprint to sign transaction of $1"... then quietly presents a $1000 charge to be signed by the PKI token. Even TPM can't help if the software is hacked.

m_eiman 16y ago

An easier way to detect something fishy would be to allow at most one connection per auth token, and invalidate it and re-request login credentials if a collision occurs. Just ping both connections first to make sure they're both actually alive, and not the same machine logging in again after a reboot-after-crash.