6 ms·

You still haven't explained what it is you expect them to do. In reality. Knowing that they have millions of customers, and that they have invested years of w

• blub 16y ago
  JungleDisk uses an encryption key protected by an additional password. To access your files online you have to provide this additional password which is used to decrypt the encryption key for the actual data. Granted, they can still steal your password...
  • palish 16y ago
    Let me be more clear. You are now Drew. You start this morning by visiting Hacker News. "Dear god," you exclaim, "I've been such a fool! We've been Doing It Rong all these years!" Inspired by this new revelation, you spring out of your chair and out the door. You stride into "The Programmer Pit" and over to the new hire, backhanding him across the face. "Get the hell off of Portal 2! We have work to do! Jessica, go pick up four cases of Red Bull --- It worked at MIT, it'll work here." Now that you have Acquired Their Attention, you say, "Okay, here's-a what we gonna do. Step 1: Jimmy, I want you to ..." ... Now. What, exactly, fellow HNers, is Step 1? Fill in the blank. What, step-by-step, do you want Dropbox to do?
    • tomstuart 16y ago
      Can't we all agree, at least, that step one should be to clearly admit that they lied? Maybe they don't need to do anything else. Dropbox is a fine service as it stands; security must be traded off against convenience, and the trade-off that Dropbox makes is acceptable to lots of people. They do have a responsibility to make sure that those people understand the trade-off, though, as well as a responsibility to admit that they've swept important details under the carpet in the past.
    • mike-cardwell 16y ago
      Add an option to create secure folders which are encrypted client side, using a key which is only available client side. these folders wouldn't be usable with things like the web interface because there is no server side capability to decrypt their contents.
      • palish 16y ago
        "But Drew!" Jimmy exclaims, "What if someone uses Dropbox at work and at home? Are these special folders going to be synced across computers? If so, how will the key be easily transferred (email, USB stick)? What happens when the user's hard drive crashes and his key file is lost permanently? Otherwise, if these special folders won't be synced, then what is the point of the folders being in Dropbox at all?"
        • mike-cardwell 16y ago
          Those are just minor implementation details. Off the top of my head, the key can be stored as a password protected file inside the Dropbox account its self, synced like any normal file, but perhaps hidden from the end user. The encrypted folders contents are synced like any others. On any client where you want to access the decrypted folder contents, you'd just enter the password to decrypt the password protected key and the folder contents would become available. If you forget the password then you're screwed. The only way Dropbox could access those files then would be to backdoor the Dropbox client. But if they were going to do that, it wouldn't even be safe to use TrueCrypt or GnuPG either.
      • fluidcruft 16y ago
        Why wait? Do that today: use ecryptfs.
        • mike-cardwell 16y ago
          Will that work with the Dropbox clients on my Android phone, my Android tablet, my Windows desktop, my OSX laptop and my Linux server? If not, then it's no use to me.
    • fluidcruft 16y ago
      I resent that you sent the female to fetch drinks. Mix it up once in a while and send the queer.
    • eps 16y ago
      1. Say "we take reasonable precautions to protect your files, but we are capable of accessing their content at any time."
      • simpleTruth 16y ago
        I suspect the truth is closer to: "Our goal is for no single employee acting alone is able to access your files. However, there is a procedure where multiple people working in concert can recover your files and provide them to law enforcement. Unfortunately, it is possible for a hacker / programmer to create a backdoor and there is nothing we can do about this."
  • sunchild 16y ago
    In the beginning, JungleDisk allowed users to manage their own keys from the client-side without ever sharing the key with JungleDisk. I think they dropped this feature subsequently, and there must have been a reason... too many problems with users losing their keys? Encryption is always a trade-off, since it introduces the possibility of total data loss if the key is mismanaged.
• extension 16y ago
  Why should any critic have to explain what they should do? Perhaps they can do nothing. This doesn't absolve them of guilt. Personally, I'd let them off the hook if they admitted their previous deception and explained the limitations of their security model in terms that any user can understand.
• kragen 16y ago
  What do I expect them to do? In reality? I expect them to continue to lie, defraud their customers, and attack the credibility of anyone who criticizes them, treating this as a public relations issue instead of an issue of personal integrity.
• cabalamat 16y ago
  > So, playing devil's advocate for the moment --- and taking the above facts into account --- what, precisely, would you do in their position? That depends on the law. Is it legal in the US to store someone else's strongly encrypted data on one's server? Assuming it is, then they should encrypt by default and then if law enforcement forces them to give up data, give what they have.