3 ms·

Sorry. I just don't get it. Why are people so surprised by this? I think the people that are shocked are people that just don't bother to think about the device

Sorry. I just don't get it. Why are people so surprised by this? I think the people that are shocked are people that just don't bother to think about the devices they use. This is the danger of this whole "ooooh it's magic" shellac marketing craze everyone seems caught up in. All of this should have been obvious to anyone that bothered to think about what was going on before they stored their precious secrets in Dropbox. Obviously they are holding the encryption keys. Hell, that much was obvious to me when I started using/testing Dropbox just over a year ago and saw my files served over a web page. I can't help but muster a "meh". The value I saw in their use of encryption is this: when they or amazon or whoever dispose of their drives it will be harder to harvest data off of them. That's all I've come to expect from them and that's all any of their information has ever warranted. I still derive great value from their service. Now, I will admit the one that I personally didn't think through back then was the key file thing, but really that's just the same as having an ssh private key. I was aware that it wasn't constantly prompting me for a password so at some level I knew it was going on. Maybe I would prefer some sort of passphrase at login using a keyring for that file. Minor issue. I do trust them that the run-of-the-mill support personnel are barred from accessing the keystore. Its entirely feasible that there is no mechanism for them to just go browse around your files. However, it should be blatantly obvious to anyone that understands anything about encryption that someone somewhere at dropbox can access your files. This has always been the case and obvious. I guess I'm mostly amused by people that are surprised by any of this. The smarter they pretend to think they are, the more amusing they "fell" for something this obvious. It's like the people that fall for mint.com's attempts to obscure the fact that they store your bank account usernames and passwords (oh, sorry, I forgot, they pay a third party to do that for them instead). People just don't think through the mechanisms of their shiny trinkets. You get to just point and laugh.

IgorPartola 16y ago
Agreed. Pausing to think about how it is that you are able to share a file that is stored as encrypted over the web with your friends will provide a clue. Now, if only there was an cross-platform (mobile + desktop) solution that would allow me to store files I encrypted on Dropbox. That would be pretty killer.
tomstuart 16y ago
It is completely reasonable for a layman to believe that his files are protected by a password, and therefore that nobody can access those files without the password. You don't have to be an idiot to have that mental model, especially when Dropbox reinforce it with explicit statements like "Dropbox employees aren't able to access user files". It's a consumer service, and consumers don't know or care how encryption works. They just need to be told the consequences of whatever technical decisions have been made on their behalf, so it's important for Dropbox to be honest in explaining them.
- fluidcruft 16y ago
  It's also completely reasonable for laymen to assume that the government can gain access to their Dropbox files. I don't recall Dropbox ever claiming anywhere that they would be technologically incapable of complying with a subpoena.
  - kragen 16y ago
    When they said, "Dropbox employees aren't able to access user files", they were saying they were incapable of complying with a subpoena.
    - fluidcruft 16y ago
      Perhaps. I don't think it's appropriate to edit out the context of that statement. What was actually said was "Dropbox employees aren’t able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents)". I don't think that statement as a whole necessarily responds to their capabilities to answer a subpoena. I don't think the lay public would conflate the two contexts.
- qq66 16y ago
  It's reasonable for a layman to assume that Google can't read his Gmail? That Facebook can't see your private messages? We need to have higher expectations of "laymen."
bxr 16y ago
>All of this should have been obvious to anyone that bothered to think about what was going on This is easy to claim, but we live in a world of tech. You need to step back and get some perspective. We have piles and piles of domain specific knowledge, the layman can barley set up a home router. Dropbox claims to have over 25 million customers. How many of those people do you expect to even have the knowledge to be able to figure this out? You're putting the burden of realizing dropbox's claims don't hold water on the consumer, who probably doesn't understand a single thing about cryptography. Even if every one could figure it out, they still shouldn't have to. >I guess I'm mostly amused by people that are surprised by any of this. I wasn't surprised by any of this, what I am surprised by is people who see others trying to raise consumer awareness and are so quick to dismiss them just because they happen to be among the few who actually do understand the technical limitations of the cryptography implementation used.
extension 16y ago
Why does the degree of surprise matter? That a betrayal is expected does not make it alright.

IgorPartola 16y ago

Agreed. Pausing to think about how it is that you are able to share a file that is stored as encrypted over the web with your friends will provide a clue. Now, if only there was an cross-platform (mobile + desktop) solution that would allow me to store files I encrypted on Dropbox. That would be pretty killer.

tomstuart 16y ago

It is completely reasonable for a layman to believe that his files are protected by a password, and therefore that nobody can access those files without the password. You don't have to be an idiot to have that mental model, especially when Dropbox reinforce it with explicit statements like "Dropbox employees aren't able to access user files". It's a consumer service, and consumers don't know or care how encryption works. They just need to be told the consequences of whatever technical decisions have been made on their behalf, so it's important for Dropbox to be honest in explaining them.

fluidcruft 16y ago
It's also completely reasonable for laymen to assume that the government can gain access to their Dropbox files. I don't recall Dropbox ever claiming anywhere that they would be technologically incapable of complying with a subpoena.
- kragen 16y ago
  When they said, "Dropbox employees aren't able to access user files", they were saying they were incapable of complying with a subpoena.
  - fluidcruft 16y ago
    Perhaps. I don't think it's appropriate to edit out the context of that statement. What was actually said was "Dropbox employees aren’t able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents)". I don't think that statement as a whole necessarily responds to their capabilities to answer a subpoena. I don't think the lay public would conflate the two contexts.
qq66 16y ago
It's reasonable for a layman to assume that Google can't read his Gmail? That Facebook can't see your private messages? We need to have higher expectations of "laymen."

bxr 16y ago

>All of this should have been obvious to anyone that bothered to think about what was going on This is easy to claim, but we live in a world of tech. You need to step back and get some perspective. We have piles and piles of domain specific knowledge, the layman can barley set up a home router. Dropbox claims to have over 25 million customers. How many of those people do you expect to even have the knowledge to be able to figure this out? You're putting the burden of realizing dropbox's claims don't hold water on the consumer, who probably doesn't understand a single thing about cryptography. Even if every one could figure it out, they still shouldn't have to. >I guess I'm mostly amused by people that are surprised by any of this. I wasn't surprised by any of this, what I am surprised by is people who see others trying to raise consumer awareness and are so quick to dismiss them just because they happen to be among the few who actually do understand the technical limitations of the cryptography implementation used.

extension 16y ago

Why does the degree of surprise matter? That a betrayal is expected does not make it alright.