5 ms·
If the key file is stored on Dropbox servers, then Dropbox has access to all of your files. This defeats the original purpose (security). If the key file is n
by palish 16y ago
If the key file is stored on Dropbox servers, then Dropbox has access to all of your files. This defeats the original purpose (security).
If the key file is not stored on Dropbox servers, then you can't easily use Dropbox across several different computers. This defeats the other purpose (accessibility).
- shin_lao 16y agoYou can store a key escrow on the dropbox server protected by a password or a token. Just a matter of designing something secure and useable. Not easy, but possible.
- piaskal 16y agoWhen you forget your password you'll lose access to all of your data. Password recovery won't be possible if the key is password protected.
- JoachimSchipper 16y agoThat doesn't work, Dropbox/your favourite TLA will just wait for you to supply the password and then save the key. Trading off the inconveniences of good crypto (e.g. no web interface) for that little security isn't worth it.
- caf 16y agoThe system suggested by shin_lao does not require that the password be passed back to Dropbox to retrieve the key.
- JoachimSchipper 16y agoIf Dropbox wants to serve the files to a standard browser, it does need the decryption key. If I misunderstood and shin_loa wants to drop the web interface, why "key escrow" - why not directly derive the key from the passphrase?