3 ms·
"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed" This is not the same as "is not accessible to employee
by mentat 16y ago
"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed"
This is not the same as "is not accessible to employees". Interfaces are just that. There are quite a few very sharp developers at Dropbox if reputations are to be believed. I don't think an interface is a sufficient control.
- sunchild 16y agoI fully understand your point, but those words could be interpreted either way. Only Dropbox can confirm whether it is theoretically possible for Dropbox engineers to peek at user data.
- IgorPartola 16y agoDropbox keeps your encryption key somewhere. They say that (a) the files stored with them are encrypted and (b) you don't have the decryption key. Conclusion: they have your plain-text key. Thus it is theoretically possible. I take their statement that their employees cannot view your files as "their employees are not allowed to view your files" with some basic precautions surrounding this. However, whoever wrote the code for revealing the plain-text key to the server when you request a file should be smart enough to figure out how to fake being that server.
- sunchild 16y agoRight, so "...is not accessible to employees" is very misleading and arguably incorrect.
- newman314 16y agoSharp developers != sharp developers who understand how to properly implement security into product. I think it's been shown multiple times that smarts devs that do not do security all the time still are susceptible to making mistakes about security. IMO, this is one of those cases. Miguel is right in calling for an audit but even better, Dropbox could just ask for help. I'm sure any number of savvy HN peeps would be happy to help.