3 ms·
It's even less than that, as with dropbox you cannot 'capture' someones cookie using firesheep or a sniffer, as they use TLS. The only way to steal the key is b
by wladimir 16y ago
It's even less than that, as with dropbox you cannot 'capture' someones cookie using firesheep or a sniffer, as they use TLS. The only way to steal the key is by hacking into someones computer and copying it.
Dropbox is doing nothing wrong here. All computer security suffers from this issue. When your machine is compromised, security is toast and you better damn fast change all your passwords/ssh keys/...
No amount of security by obscurity will change this basic fact. The article is extremely alarmist and really doesn't tell anything new.
- merijnv 16y agoWell, I would argue that they are doing something wrong. You're absolutely right to say that there is no reason to do something other then just storing the key locally (since someone who has local access to the key, can presumably access your entire dropbox already anyway). But as the original author points out, the fact that changing your dropbox password does not invalidate existing tokens is an issue.
- wladimir 16y agoAgreed. Limiting key lifetime in that way is an essential feature that improves security. But the title is worded like he found a structural security hole, that's simply inflammatory and annoyed me.