> The mere fact that they perform deduplication, which is not possible if they can't read your data It is possible because it's client-server. When a new file

> The mere fact that they perform deduplication, which is not possible if they can't read your data It is possible because it's client-server. When a new file appears in the Dropbox folder, the Dropbox client calculates a hash of it and checks if that hash already exists with Dropbox's server-side storage. If not, then the file is uploaded and stored encrypted. You do have to trust that the Dropbox client is actually doing what it claims to do, that it isn't uploading with no or trivial encryption (like an xor or something.)