3 ms·
Three points: 1. Sensationalism aside, Dropbox should review questionable security claims to reduce false sense of security if any. With millions of users, car
by donpark 16y ago
Three points:
1. Sensationalism aside, Dropbox should review questionable security claims to reduce false sense of security if any. With millions of users, careless words formed out of marketing needs are no longer needed. What Dropbox users need now is more clear picture of what they are giving up to gain Dropbox's services.
2. The weakest security link is the user and their computer, not Dropbox which has enough financial incentives at stake to be diligent security wise. In the end, no computer open to external data or code is safe. What protect most users today is actually not security technologies but cost/benefit ratio to potential attackers, tempered by goal and scale. 99.9999% of Dropbox user data is useless to attackers and cost of mining questionable nuggets out continually expanding sea of data from 20 million users is not a trivial task.
3. While it's true that user must trust Dropbox in the end, some of its security measures could use strengthening even if it's just intended to raise the level of sophistication necessary to steal Dropbox data.
- latch 16y agoAgreed. Except a lot of companies have a lot of " financial incentives at stake to be diligent security wise" but aren't. Something I very recently heard: "World of Warcraft has had RSA-style two-factor token authentication for years, and my bank still doesn't"
- donpark 16y agoSome thoughts re WoW vs banks: WoW Authenticator is optional, costs $30~40, and intended for serious WoW players in a community with very strong peer support. Banks can do first two but don't have a community of tech savvy users to reduce cost of support manageable. So Blizzard could but banks couldn't. Will this change? I think so but it'll have to be opt-in and paid for by customers, likely through third-party services first.
- TillE 16y agoEvery bank in Germany (that I know of) uses TAN lists. They mail you a list of generated numbers, and for each transaction, you need to enter one of those numbers, which is then consumed. No fancy gadgetry required. Just a sheet of paper gives you all the same security advantages.
- Pahalial 16y ago$6.50, not 30-40: http://us.blizzard.com/store/search.xml?q=authenticator http://us.blizzard.com/store/search.xml?q=authenticator - this omits the free apps for most smartphones. As far as peer support, honestly, there's almost no peer support. There is a strong first-line of FAQs and automated systems (regularly ensuring secondary contact information is accurate, well-defined systems for lost authentication devices,etc) and well-trained second-tier tech support. There are enough third-party auth providers now that would be well able to provide the entire support chain for the banks. In fact, Gemalto has built for this: http://www.gemalto.com/financial/ebanking/ http://www.gemalto.com/financial/ebanking/