10 ms·

New security issue at Dropbox

270 points by davewiner 15y ago

trebor 15y ago
Well, this definitely cinches it. I had stuck with Dropbox thru the whole "your files aren't THAT encrypted" debacle because I have nothing worth hiding. But, this complete incompetence has convinced me that it isn't worth the risk! I'm not as highly paid as the Dropbox guys are, I'm sure, but even I know to test authentication with automated tests. Oh, and not to let things that fail tests through to production! What if I had archived my bank records there and someone go ahold of them? Thankfully I'm still just a little too paranoid for that. I'm moving to Wuala or rsync.net; before I try the latter I want to test Wuala.
- pavel_lishin 15y ago
  > I have nothing worth hiding. Mind putting up a mirror of your Dropbox folder?
  - trebor 15y ago
    Heh, that'd take maybe 60 seconds. I've only got a few articles that I've saved, a few screen shots, and one tiny demo project. As I said, it wasn't worth worrying about.
- TheEskimo 15y ago
  You missed the option of SpiderOak. It's very similar to dropbox and, to my knowledge, has impeccable security.
davewiner 15y ago
I haven't tried to reproduce this yet, but if it's true, it's quite serious.
- michael_dorfman 15y ago
  I just tried, and failed to reproduce. So, at the moment, there's nothing to see here.
  - quinndupont 15y ago
    Still. MY god this is worrisome.
- jeffreyg 15y ago
  the tech support reponse quoted on the page: hi XXX, there was a very brief glitch and this should never happen/be possible again. thanks for the email. -arash
- JoachimSchipper 15y ago
  Dropbox very temporarily failed open (i.e. let people in without actually verifying their password). The question is, do they fail open under a DoS attack on the machines handling authentication? Do they fail open if you just run enough login attempts?
jontas 15y ago
I cannot reproduce.
- ch0wn 15y ago
  Read the complete correspondence. It was fixed.
  - sorbus 15y ago
    Or was never an issue in the first place.
- kennywinker 15y ago
  Have you been to a fertility clinic? There are some treatment options available.
lordlarm 15y ago
This is the sort of thing where the submitter (at pastebin in this case) should be absolutly sure that the bug is fixed from Dropbox' side before telling the hole world about it. This way everyone is happy, and not to mention safe. I'm so tired of seeing all these username/password leaks lately. It is not doing anyone anything good, except from teenagers and thieves which thinks it is funny to empty Amazon accounts or upload nude pictures on Facebook (etc. etc.) So, in all fairness, the submitter did actually contact Dropbox first (which is great), but please wait until they definitely have fixed before telling the world about it. Or at least, that is my humble opinion.
- owenmarshall 15y ago
  The poster did contact Dropbox and was told, essentially, "it's a glitch, don't worry about it." The poster was not told any details about "the glitch" -- we don't know if it was a one-time issue, or if it represents a deeper architectural issue. In this case, full disclosure is absolutely warranted. Applying the most optimistic reading, Dropbox fixed the problem, so disclosure is fine. The most pessimistic would say that the problem still exists, and that disclosure will cause exposure, but will also prompt further scrutiny to the issue.
- sokoloff 15y ago
  > before telling the hole world about it. Unclear if the pun was intended or not, but amusing either way...
ltamake 15y ago
Doesn't work.
mike-cardwell 15y ago
https://www.dropbox.com/help/27 https://www.dropbox.com/help/27 "Your files are backed-up, stored securely, and password-protected." Except, apparently, you don't even need to know the password to get access to the unencrypted files. I wish somebody would clone exactly what Dropbox does, but get the encryption/security right so that it is impossible for anyone other than the account owner to access their files. Dropbox will never get security right.
- yuvadam 15y ago
  Dropbox will never get security right I fail to see how you conclude that. Yes, they did have several glitches in the past, and no, they did not always respond as they should have. But there are some pretty smart people working at Dropbox. What makes you think they do not have the capacity to solve security issues?
  - arethuza 15y ago
    I suspect what that comment means is that Dropbox have traded security for ease of use at a fundamental level - compared to something like tarsnap (which is dedicated to doing backups in a very secure way) Dropbox does look a lot less secure but it is also a lot easier to use and supports a much wider ranges of uses. Edit: I am a pretty happy DropBox user, but I only store files there that I wouldn't really care too much if they were made public. DropBox to me is about convenience, not about security. Edit2: I was a pretty happy DropBox user, now that I think about what having a system that is prone to "failing open" means I'm seriously thinking about closing my account. However, I'll wait and see what the "official" explanation is first.
  - mike-cardwell 15y ago
    They should have made it so files can only be encrypted/decrypted client side. They sacrificed this security so that they could do two extra things. 1.) De-duplication 2.) Web access to the files. They also sacrificed the security of the mobile clients by disabling SSL, in exchange for a small speed increase. Those are the main reasons I have come to this conclusion.
mike-cardwell 15y ago
Dropbox owes their customers a public explanation.
- crocowhile 15y ago
  Yes, I agree. But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank. It seems too big and too weird to be true. edit: This is the guy who reported the "glitch" https://twitter.com/#!/csoghoian https://twitter.com/#!/csoghoian seems legit. I am shocked.
  - walrus 15y ago
    Legit and fairly well known: https://secure.wikimedia.org/wikipedia/en/wiki/Christopher_Soghoian https://secure.wikimedia.org/wikipedia/en/wiki/Christopher_S...
  - gobongo 15y ago
    "But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank." Various big-name dropbox people are likely aware of this thread now based on their quick responses to previous threads here at HN. The fact that they've said nothing here is virtually an admission that there was a problem. It only takes a few seconds to bang out a 'this claim has no merit' post if it indeed does have no merit. The question is, are they working on some sort of official statement to make (which would have to be exactly worded and thus I can understand the lag time) or are they ducking down and hoping this will just blow over? IMO they absolutely need to address this very soon, and not just as a one line email that promises it'll never happen again.
    - crocowhile 15y ago
      Yes, I agree with all you write now. It just seemed such a weird issue though. Hard to imagine how something like this can happen accidentally.
bxr 15y ago
Last time the Dropbox security thing was in the news, regardless of your personal preference on what encryption keys dropbox should have been using, the issue and more importantly the way they handled it made me question their abilities. Then they sent a DMCA takedown notification notification to someone they were just trying to censor, and now they temporarily set their auth method to "allow any password". They are showing us that they are technologically incompetent at managing their own systems. I don't know why anyone continues to do buisness with them for files they want any sort of privacy over. I've moved to rsync.net. Its uglier, but at least they know what the fuck they're doing.
- brown9-2 15y ago
  Then they sent a DMCA takedown notification notification to someone they were just trying to censor It came out in the aftermath that the takedown notice was the result of an automated process that was accidentally triggered.
  - bxr 15y ago
    I know. I didn't bring that up to accuse them of malice as far the DMCA part, I brought that up as an example that dropbox employees don't understand what their own internal tools do.
    - SoftwareMaven 15y ago
      I don't think that is as damning as you seem to. Once a company reaches more than a handful of people, knowing all the tools inside and out (especially in the divide between development and support, which this particular case highlighted) becomes impossible. However, regardless of whether I feel like the previous event said anything about DropBox's development capabilities, I do feel like this event does. I'm responsible for the authentication code for my company. I can't imagine having a default "YES" in any circumstance, and that DropBox did shakes my faith in them and their ability to protect my information significantly.
- nokcha 15y ago
eli 15y ago
"there was a very brief glitch and this should never happen/be possible again. thanks for the email." Yikes
deleted 15y ago
[deleted]
- CWuestefeld 15y ago
  Shouldn't Dropbox be sued for this? What's your standing -- how were you harmed? What are the damages? You can't sue someone just because you don't like their behavior. You need to actually suffer a loss as a result of their behavior, before you've got any standing in court.
brk 15y ago
People have been slamming Dropbox quite a bit, and it's not all entirely unwarranted. I think that part of this is how Dropbox is handling things, and the fact they appear to be growing faster than they can code. I'd love to see them offer something like a free lifetime 50GB account for anyone the submits a high security reproducible bug like this. Sure, they may end up giving out a couple of terabytes of free space, but the intense QA they would get for free would likely be worthwhile.
Jasber 15y ago
A slight tangent... I recently looked into password managers myself after the MtGox leak. I tried 1Password and LastPass. While both do what they say--I found them cumbersome to use. I settled on a scheme like this: E-mail: Very strong, completely unique. 2-factor auth. If you have my e-mail, it's game over. Bank: Very strong, completely unique. The rest of the passwords I've broken down into tiers. I've memorized a password for each tier combined with a hashing algorithm stored in my head. The theory here being if an entire tier gets compromised (someone figures out my hashing scheme), at the very worst I lose the entire tier. This does keep me safe from automated attacks, but not if someone singled me out individually. Which in that case, I've got other problems. This isn't perfect, but it gives me a couple of things I really value: - Keep all passwords in my head - Unique passwords on each site - Tiered passwords so if someone figures out my hashing scheme, they only get that tier I like the idea of password managers, but in practice they were too much hassle for me.
- kenjackson 15y ago
  Curious, why did you find PW managers too cumbersome to use? I use one, but I feel like I'm more willing to use something cumbersome. But I think that most ppl feel the same way you do. It seems like a huge startup opportunity to do what DropBox did, and make PW managers easy for average Joe. I think most people recognize the need.
  - Jasber 15y ago
    Both LastPass and 1Password failed to save some generated passwords for me, causing too many trips to forgot password. LastPass would sometimes post to the wrong login form. 1Password got confused a couple of times between 'Logins' and 'Accounts'. With 1Password, when I'm away from my computer, I have to use my phone to read my passwords. If my phone dies (fairly common) I have to install the password manager (not always possible). With LastPass I can access their web interface--but experienced too many of the issues above. Plus I am a little nervous about a 3rd party having that much power. I'm sure all of this was my fault, but the end result was I discovered many hidden costs and it felt like I was fighting against them.
deleted 15y ago
[deleted]
peterwwillis 15y ago
It's 2011. Why are people still surprised when some blatant hole is found in a site? Does everyone just delude themselves into thinking "oh, they HAVE to be secure"? That old cliche 'nothing is totally secure' is almost right: the reality is, everything is mostly-not secure. Tips on never getting caught with your pants down by a 3rd party service: 1. Never ever rely on a service maintained by a 3rd party to remain secure. Just assume they will be compromised in the near future (including your password). 2. Make your password strong but don't reuse it; save it in your browser password cache or keyring. Use a memorized really-freaking-difficult master password for the browser cache/keyring. 3. Use NoScript and updated browsers to help prevent XSS and other simple attacks from compromising your cached cookies. 4. Encrypt all sensitive stored information yourself using a well-vetted tool such as gpg, openssl, etc and store the encrypted files on the 3rd party service. 5. Keep hard copies of your secure files, keys, etc in a secure location. 'The Cloud' is not a backup, it's a trap.
- pavel_lishin 15y ago
  > That old cliche 'nothing is totally secure' is almost right: the reality is, everything is mostly-not secure. A security hole is one thing, but something like being able to log into anyone's account with whatever you'd like as the password? Or changing a digit in a URL and accessing someone else's account? Come on, that's like the guards at Fort Knox leaving all of the doors open directly to the gold, or the Secret Service collectively going out for a smoke break during a presidential parade.
  - peterwwillis 15y ago
    If you're relying on a cloud-hosted startup to secure gold or the president, you're doing it very, very, very wrong. The level of complexity of an attack and the ridiculousness of a hole are almost completely arbitrary in terms of compromising the security of a service. The biggest attacks of the past 6 months were performed either using social engineered credentials or extremely common web application vulnerabilities (so common that probably every hole used is on OWASP's Top 10 security holes). The only reason Fort Knox or the Secret Service works is because it relies on humans spending 100% of their time actively focusing on security, 24 hours a day, every day. No web service I have ever heard of has that level of security. As far as this particular hole: it's probably a bug somebody left in some code by accident and nobody foresaw the consequences. There are bugs like this in every system. The only reason you don't see more of these holes is because either nobody's looking for them or somebody found it and is keeping it very secret.
deleted 15y ago
[deleted]
presidentender 15y ago
For the record, Arash isn't some random support guy, he's the CTO. That means the support team properly escalated this way up the food chain very quickly, and I'd be extremely surprised if we didn't see a response from Dropbox later today.
crocowhile 15y ago
Other people noticed this on the dropbox forum: http://forums.dropbox.com/topic.php?id=40113 http://forums.dropbox.com/topic.php?id=40113
georgemcbay 15y ago
There's a blog post addressing this incident now on the dropbox blog: http://blog.dropbox.com/?p=821 http://blog.dropbox.com/?p=821 It is very light on details of how exactly the problem occured other than saying it was due to a bug in a code update.
- jevinskie 15y ago
  They say that less than 1% of all of their users logged in during the vulnerable time frame. I suspect those are weasel words to downgrade the apparent severity of the problem. A more useful metric would be # user logins during vulnerable timeframe / # user logins per day.
- nupark2 15y ago
  The fact that this could happen is a fairly significant indictment of their technical capabilities and the amount of trust they deserve when it comes to safe-guarding your data. If there's anyway in your code that deserves unit and integration tests, it's your authentication system.

270 points by davewiner 15y ago

Well, this definitely cinches it. I had stuck with Dropbox thru the whole "your files aren't THAT encrypted" debacle because I have nothing worth hiding. But, this complete incompetence has convinced me that it isn't worth the risk! I'm not as highly paid as the Dropbox guys are, I'm sure, but even I know to test authentication with automated tests. Oh, and not to let things that fail tests through to production! What if I had archived my bank records there and someone go ahold of them? Thankfully I'm still just a little too paranoid for that. I'm moving to Wuala or rsync.net; before I try the latter I want to test Wuala.

pavel_lishin 15y ago
> I have nothing worth hiding. Mind putting up a mirror of your Dropbox folder?
- trebor 15y ago
  Heh, that'd take maybe 60 seconds. I've only got a few articles that I've saved, a few screen shots, and one tiny demo project. As I said, it wasn't worth worrying about.
TheEskimo 15y ago
You missed the option of SpiderOak. It's very similar to dropbox and, to my knowledge, has impeccable security.

davewiner 15y ago

I haven't tried to reproduce this yet, but if it's true, it's quite serious.

michael_dorfman 15y ago
I just tried, and failed to reproduce. So, at the moment, there's nothing to see here.
- quinndupont 15y ago
  Still. MY god this is worrisome.
jeffreyg 15y ago
the tech support reponse quoted on the page: hi XXX, there was a very brief glitch and this should never happen/be possible again. thanks for the email. -arash
JoachimSchipper 15y ago
Dropbox very temporarily failed open (i.e. let people in without actually verifying their password). The question is, do they fail open under a DoS attack on the machines handling authentication? Do they fail open if you just run enough login attempts?

jontas 15y ago

I cannot reproduce.

ch0wn 15y ago
Read the complete correspondence. It was fixed.
- sorbus 15y ago
  Or was never an issue in the first place.
kennywinker 15y ago
Have you been to a fertility clinic? There are some treatment options available.

lordlarm 15y ago

This is the sort of thing where the submitter (at pastebin in this case) should be absolutly sure that the bug is fixed from Dropbox' side before telling the hole world about it. This way everyone is happy, and not to mention safe. I'm so tired of seeing all these username/password leaks lately. It is not doing anyone anything good, except from teenagers and thieves which thinks it is funny to empty Amazon accounts or upload nude pictures on Facebook (etc. etc.) So, in all fairness, the submitter did actually contact Dropbox first (which is great), but please wait until they definitely have fixed before telling the world about it. Or at least, that is my humble opinion.

owenmarshall 15y ago
The poster did contact Dropbox and was told, essentially, "it's a glitch, don't worry about it." The poster was not told any details about "the glitch" -- we don't know if it was a one-time issue, or if it represents a deeper architectural issue. In this case, full disclosure is absolutely warranted. Applying the most optimistic reading, Dropbox fixed the problem, so disclosure is fine. The most pessimistic would say that the problem still exists, and that disclosure will cause exposure, but will also prompt further scrutiny to the issue.
sokoloff 15y ago
> before telling the hole world about it. Unclear if the pun was intended or not, but amusing either way...

ltamake 15y ago

Doesn't work.

mike-cardwell 15y ago

https://www.dropbox.com/help/27 https://www.dropbox.com/help/27 "Your files are backed-up, stored securely, and password-protected." Except, apparently, you don't even need to know the password to get access to the unencrypted files. I wish somebody would clone exactly what Dropbox does, but get the encryption/security right so that it is impossible for anyone other than the account owner to access their files. Dropbox will never get security right.

yuvadam 15y ago
Dropbox will never get security right I fail to see how you conclude that. Yes, they did have several glitches in the past, and no, they did not always respond as they should have. But there are some pretty smart people working at Dropbox. What makes you think they do not have the capacity to solve security issues?
- arethuza 15y ago
  I suspect what that comment means is that Dropbox have traded security for ease of use at a fundamental level - compared to something like tarsnap (which is dedicated to doing backups in a very secure way) Dropbox does look a lot less secure but it is also a lot easier to use and supports a much wider ranges of uses. Edit: I am a pretty happy DropBox user, but I only store files there that I wouldn't really care too much if they were made public. DropBox to me is about convenience, not about security. Edit2: I was a pretty happy DropBox user, now that I think about what having a system that is prone to "failing open" means I'm seriously thinking about closing my account. However, I'll wait and see what the "official" explanation is first.
- mike-cardwell 15y ago
  They should have made it so files can only be encrypted/decrypted client side. They sacrificed this security so that they could do two extra things. 1.) De-duplication 2.) Web access to the files. They also sacrificed the security of the mobile clients by disabling SSL, in exchange for a small speed increase. Those are the main reasons I have come to this conclusion.

mike-cardwell 15y ago

Dropbox owes their customers a public explanation.

crocowhile 15y ago
Yes, I agree. But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank. It seems too big and too weird to be true. edit: This is the guy who reported the "glitch" https://twitter.com/#!/csoghoian https://twitter.com/#!/csoghoian seems legit. I am shocked.
- walrus 15y ago
  Legit and fairly well known: https://secure.wikimedia.org/wikipedia/en/wiki/Christopher_Soghoian https://secure.wikimedia.org/wikipedia/en/wiki/Christopher_S...
- gobongo 15y ago
  "But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank." Various big-name dropbox people are likely aware of this thread now based on their quick responses to previous threads here at HN. The fact that they've said nothing here is virtually an admission that there was a problem. It only takes a few seconds to bang out a 'this claim has no merit' post if it indeed does have no merit. The question is, are they working on some sort of official statement to make (which would have to be exactly worded and thus I can understand the lag time) or are they ducking down and hoping this will just blow over? IMO they absolutely need to address this very soon, and not just as a one line email that promises it'll never happen again.
  - crocowhile 15y ago
    Yes, I agree with all you write now. It just seemed such a weird issue though. Hard to imagine how something like this can happen accidentally.

bxr 15y ago

Last time the Dropbox security thing was in the news, regardless of your personal preference on what encryption keys dropbox should have been using, the issue and more importantly the way they handled it made me question their abilities. Then they sent a DMCA takedown notification notification to someone they were just trying to censor, and now they temporarily set their auth method to "allow any password". They are showing us that they are technologically incompetent at managing their own systems. I don't know why anyone continues to do buisness with them for files they want any sort of privacy over. I've moved to rsync.net. Its uglier, but at least they know what the fuck they're doing.

brown9-2 15y ago
Then they sent a DMCA takedown notification notification to someone they were just trying to censor It came out in the aftermath that the takedown notice was the result of an automated process that was accidentally triggered.
- bxr 15y ago
  I know. I didn't bring that up to accuse them of malice as far the DMCA part, I brought that up as an example that dropbox employees don't understand what their own internal tools do.
  - SoftwareMaven 15y ago
    I don't think that is as damning as you seem to. Once a company reaches more than a handful of people, knowing all the tools inside and out (especially in the divide between development and support, which this particular case highlighted) becomes impossible. However, regardless of whether I feel like the previous event said anything about DropBox's development capabilities, I do feel like this event does. I'm responsible for the authentication code for my company. I can't imagine having a default "YES" in any circumstance, and that DropBox did shakes my faith in them and their ability to protect my information significantly.
nokcha 15y ago

eli 15y ago

"there was a very brief glitch and this should never happen/be possible again. thanks for the email." Yikes

deleted 15y ago

[deleted]

CWuestefeld 15y ago
Shouldn't Dropbox be sued for this? What's your standing -- how were you harmed? What are the damages? You can't sue someone just because you don't like their behavior. You need to actually suffer a loss as a result of their behavior, before you've got any standing in court.

brk 15y ago

People have been slamming Dropbox quite a bit, and it's not all entirely unwarranted. I think that part of this is how Dropbox is handling things, and the fact they appear to be growing faster than they can code. I'd love to see them offer something like a free lifetime 50GB account for anyone the submits a high security reproducible bug like this. Sure, they may end up giving out a couple of terabytes of free space, but the intense QA they would get for free would likely be worthwhile.

Jasber 15y ago

A slight tangent... I recently looked into password managers myself after the MtGox leak. I tried 1Password and LastPass. While both do what they say--I found them cumbersome to use. I settled on a scheme like this: E-mail: Very strong, completely unique. 2-factor auth. If you have my e-mail, it's game over. Bank: Very strong, completely unique. The rest of the passwords I've broken down into tiers. I've memorized a password for each tier combined with a hashing algorithm stored in my head. The theory here being if an entire tier gets compromised (someone figures out my hashing scheme), at the very worst I lose the entire tier. This does keep me safe from automated attacks, but not if someone singled me out individually. Which in that case, I've got other problems. This isn't perfect, but it gives me a couple of things I really value: - Keep all passwords in my head - Unique passwords on each site - Tiered passwords so if someone figures out my hashing scheme, they only get that tier I like the idea of password managers, but in practice they were too much hassle for me.

kenjackson 15y ago
Curious, why did you find PW managers too cumbersome to use? I use one, but I feel like I'm more willing to use something cumbersome. But I think that most ppl feel the same way you do. It seems like a huge startup opportunity to do what DropBox did, and make PW managers easy for average Joe. I think most people recognize the need.
- Jasber 15y ago
  Both LastPass and 1Password failed to save some generated passwords for me, causing too many trips to forgot password. LastPass would sometimes post to the wrong login form. 1Password got confused a couple of times between 'Logins' and 'Accounts'. With 1Password, when I'm away from my computer, I have to use my phone to read my passwords. If my phone dies (fairly common) I have to install the password manager (not always possible). With LastPass I can access their web interface--but experienced too many of the issues above. Plus I am a little nervous about a 3rd party having that much power. I'm sure all of this was my fault, but the end result was I discovered many hidden costs and it felt like I was fighting against them.

deleted 15y ago

[deleted]

peterwwillis 15y ago

It's 2011. Why are people still surprised when some blatant hole is found in a site? Does everyone just delude themselves into thinking "oh, they HAVE to be secure"? That old cliche 'nothing is totally secure' is almost right: the reality is, everything is mostly-not secure. Tips on never getting caught with your pants down by a 3rd party service: 1. Never ever rely on a service maintained by a 3rd party to remain secure. Just assume they will be compromised in the near future (including your password). 2. Make your password strong but don't reuse it; save it in your browser password cache or keyring. Use a memorized really-freaking-difficult master password for the browser cache/keyring. 3. Use NoScript and updated browsers to help prevent XSS and other simple attacks from compromising your cached cookies. 4. Encrypt all sensitive stored information yourself using a well-vetted tool such as gpg, openssl, etc and store the encrypted files on the 3rd party service. 5. Keep hard copies of your secure files, keys, etc in a secure location. 'The Cloud' is not a backup, it's a trap.

pavel_lishin 15y ago
> That old cliche 'nothing is totally secure' is almost right: the reality is, everything is mostly-not secure. A security hole is one thing, but something like being able to log into anyone's account with whatever you'd like as the password? Or changing a digit in a URL and accessing someone else's account? Come on, that's like the guards at Fort Knox leaving all of the doors open directly to the gold, or the Secret Service collectively going out for a smoke break during a presidential parade.
- peterwwillis 15y ago
  If you're relying on a cloud-hosted startup to secure gold or the president, you're doing it very, very, very wrong. The level of complexity of an attack and the ridiculousness of a hole are almost completely arbitrary in terms of compromising the security of a service. The biggest attacks of the past 6 months were performed either using social engineered credentials or extremely common web application vulnerabilities (so common that probably every hole used is on OWASP's Top 10 security holes). The only reason Fort Knox or the Secret Service works is because it relies on humans spending 100% of their time actively focusing on security, 24 hours a day, every day. No web service I have ever heard of has that level of security. As far as this particular hole: it's probably a bug somebody left in some code by accident and nobody foresaw the consequences. There are bugs like this in every system. The only reason you don't see more of these holes is because either nobody's looking for them or somebody found it and is keeping it very secret.

deleted 15y ago

[deleted]

presidentender 15y ago

For the record, Arash isn't some random support guy, he's the CTO. That means the support team properly escalated this way up the food chain very quickly, and I'd be extremely surprised if we didn't see a response from Dropbox later today.

crocowhile 15y ago

Other people noticed this on the dropbox forum: http://forums.dropbox.com/topic.php?id=40113 http://forums.dropbox.com/topic.php?id=40113

georgemcbay 15y ago

There's a blog post addressing this incident now on the dropbox blog: http://blog.dropbox.com/?p=821 http://blog.dropbox.com/?p=821 It is very light on details of how exactly the problem occured other than saying it was due to a bug in a code update.

jevinskie 15y ago
They say that less than 1% of all of their users logged in during the vulnerable time frame. I suspect those are weasel words to downgrade the apparent severity of the problem. A more useful metric would be # user logins during vulnerable timeframe / # user logins per day.
nupark2 15y ago
The fact that this could happen is a fairly significant indictment of their technical capabilities and the amount of trust they deserve when it comes to safe-guarding your data. If there's anyway in your code that deserves unit and integration tests, it's your authentication system.