4 ms·
Dropbox didn't lie. This is simply a misinterpretation (or misunderstanding) of what's meant by the phrase "Dropbox employees aren't able to access user files".
by csallen 16y ago
Dropbox didn't lie. This is simply a misinterpretation (or misunderstanding) of what's meant by the phrase "Dropbox employees aren't able to access user files". It's not the same as saying "It's impossible." The fact is, if you send a company your unencrypted data, it's obviously possible for them to view it at some point. Otherwise they could never encrypt it in the first place. So when they say that employees aren't able to access it, they mean that they, as a company, choose not to access it.
A good analogy is the post office. Anyone who works there and handles your mail could, if they so desired, tear open your package and steal the cookies your mother sent you. We trust them anyway, because we know they take precautions to ensure it doesn't happen. Dropbox is the same, but even tougher (I doubt the average Dropbox employee has access to their decryption mechanisms, but plenty of people at the post office can unseal your envelopes).
That said, to not acknowledge it as even possible for the company you send your data to you be able to access that data seems, to me, a bit naive. That's not the promise they made, and so the claim that they lied is false.
- loumf 16y agoThe plain English meaning of the words "aren't able to access user files" is not the same as "choose not to access user files". Dropbox could just keep keys in a store where only automated user accounts can get to them -- ones where only the founders have passwords, or they are in escrow. I think there are ways to restrict the access to founders and a fail-safe, without opening them up to anyone who works at Dropbox.
- acdha 16y agoIf you run their client you've already made the decision to trust them to behave responsibly. The rest of this discussion is simply about obfuscation.
- bxr 16y ago>We trust them anyway Much of that trust is based on the fact it is a felony, not what could just be an internal slap on the wrist.
- bajsejohannes 16y ago> if you send a company your unencrypted data There is no need for this data to be sent unencrypted. Encryption could be handled completely on the client side.