4 ms·

The authentication token can be generated and managed by the software. It would then be protected by the account password, if any (Windows and MacOS X offer thi

The authentication token can be generated and managed by the software. It would then be protected by the account password, if any (Windows and MacOS X offer this feature). Doable, and even better, you can make that a 30 € / month corporate option. ;)

palish 16y ago
If the key file is stored on Dropbox servers, then Dropbox has access to all of your files. This defeats the original purpose (security). If the key file is not stored on Dropbox servers, then you can't easily use Dropbox across several different computers. This defeats the other purpose (accessibility).
- shin_lao 16y ago
  You can store a key escrow on the dropbox server protected by a password or a token. Just a matter of designing something secure and useable. Not easy, but possible.
  - piaskal 16y ago
    When you forget your password you'll lose access to all of your data. Password recovery won't be possible if the key is password protected.
    - nikcub 16y ago
      I believe most tech users understand that and accept the compromise when they are using an 'encrypted' system
      - rmc 16y ago
        But Dropbox isn't aimed at tech users.
  - JoachimSchipper 16y ago
    That doesn't work, Dropbox/your favourite TLA will just wait for you to supply the password and then save the key. Trading off the inconveniences of good crypto (e.g. no web interface) for that little security isn't worth it.
    - caf 16y ago
      The system suggested by shin_lao does not require that the password be passed back to Dropbox to retrieve the key.
      - JoachimSchipper 16y ago
        If Dropbox wants to serve the files to a standard browser, it does need the decryption key. If I misunderstood and shin_loa wants to drop the web interface, why "key escrow" - why not directly derive the key from the passphrase?
oconnore 16y ago
Isn't one of the major cool things about dropbox that if your computer hard drive gets smashed (and thus the key is destroyed), you can still access your files somewhere else?
- wahnfrieden 16y ago
  That's why you should always keep backups of your key somewhere. Even on paper in a safe deposit box.
  - ugh 16y ago
    We are talking here about Dropbox being simple to use for everyone and you start talking about keeping backups of keys. In safe deposit boxes, no less. Wow.
    - jrockway 16y ago
      You don't need to worry about safe deposit boxes. Just don't be upset when you get a letter in the email from a law firm that's noticed some of the music in your dropbox has the same hashes as the music in someone else's dropbox. The cloud is a scary place. Making it easy to use is not necessarily a good thing.
      - ugh 16y ago
        De-duplication is not really the topic of this discussion, is it?

palish 16y ago

If the key file is stored on Dropbox servers, then Dropbox has access to all of your files. This defeats the original purpose (security). If the key file is not stored on Dropbox servers, then you can't easily use Dropbox across several different computers. This defeats the other purpose (accessibility).

shin_lao 16y ago
You can store a key escrow on the dropbox server protected by a password or a token. Just a matter of designing something secure and useable. Not easy, but possible.
- piaskal 16y ago
  When you forget your password you'll lose access to all of your data. Password recovery won't be possible if the key is password protected.
  - nikcub 16y ago
    I believe most tech users understand that and accept the compromise when they are using an 'encrypted' system
    - rmc 16y ago
      But Dropbox isn't aimed at tech users.
- JoachimSchipper 16y ago
  That doesn't work, Dropbox/your favourite TLA will just wait for you to supply the password and then save the key. Trading off the inconveniences of good crypto (e.g. no web interface) for that little security isn't worth it.
  - caf 16y ago
    The system suggested by shin_lao does not require that the password be passed back to Dropbox to retrieve the key.
    - JoachimSchipper 16y ago
      If Dropbox wants to serve the files to a standard browser, it does need the decryption key. If I misunderstood and shin_loa wants to drop the web interface, why "key escrow" - why not directly derive the key from the passphrase?

oconnore 16y ago

Isn't one of the major cool things about dropbox that if your computer hard drive gets smashed (and thus the key is destroyed), you can still access your files somewhere else?

wahnfrieden 16y ago
That's why you should always keep backups of your key somewhere. Even on paper in a safe deposit box.
- ugh 16y ago
  We are talking here about Dropbox being simple to use for everyone and you start talking about keeping backups of keys. In safe deposit boxes, no less. Wow.
  - jrockway 16y ago
    You don't need to worry about safe deposit boxes. Just don't be upset when you get a letter in the email from a law firm that's noticed some of the music in your dropbox has the same hashes as the music in someone else's dropbox. The cloud is a scary place. Making it easy to use is not necessarily a good thing.
    - ugh 16y ago
      De-duplication is not really the topic of this discussion, is it?