4 ms·

I’m curious why Dropbox is on the not recommended list here.

deleted 5y ago
[deleted]
pfundstein 5y ago
Probably similar reason to why Google/Microsoft/Apple cloud aren't on there either: You should not expect these companies to respect your privacy with regards to everything you upload to their servers.
croutonwagon 5y ago
Dropbox, at least at one point in time, did their de-duplication based on simple hashing, ACROSS accounts. It does look like they stopped that practice, but it caused quite a stir at the time So if you uploaded a ubuntu ISO and so did I, they were simply linked. This may have been disabled. They specifically advertised stuff like this wasn't being done, but turns out it was "mis-communicated". FTC complaints were even filed i believe over this. [1] The Snowden leaks revealed the encryption they used allowed Dropbox to decrypt and surrender files to third parties. Though this was widely know and the workaround had long been to encrypt a container and store it in dropbox to mitigate this and the de-duplication issues etc. They also have a tendency to strip/remove files/code they deem malicious in nature. So anything netsec related was at risk for me. Things like shell scripts etc. They actually say this is a feature, but its pretty heavy handed Not sure if that is the current behavior because due to these things i ditched them years ago and never looked back. I mostly roll my own with things like this now anyway. The only time i use a "cloud" service like this is to share something with the understood privacy risks. [1]https://web.archive.org/web/20121020152158/http://www.informationweek.com/storage/security/dropbox-accused-of-misleading-customers/229500683 https://web.archive.org/web/20121020152158/http://www.inform...
- seoaeu 5y ago
  None of the points seem all that bad to me, though I can see that their security mechanisms could cause issues if you're doing netsec. For instance is wrong with de-duplicating files on the backend provided they use a strong enough hash algorithm to avoid hash collisions?
  - jlokier 5y ago
    If it's only on the backend, a timing attack could still potentially estimate whether particular content is already on the system. Protection against subtle timing attacks on deduplication is difficult.
- beermonster 5y ago
  I used to have a mountable VeraCrypt file system image in my Dropbox to mitigate just these types of things. That was when Dropbox first started. I now have no need for Dropbox at all so no longer have an account. These days their are also lots of FOSS alternatives too.
sneak 5y ago
Dropbox isn't private. Lacking e2e encryption, everything you store on Dropbox is available to Dropbox staff as well as anyone who can coerce them.

deleted 5y ago

[deleted]

Probably similar reason to why Google/Microsoft/Apple cloud aren't on there either: You should not expect these companies to respect your privacy with regards to everything you upload to their servers.

croutonwagon 5y ago

Dropbox, at least at one point in time, did their de-duplication based on simple hashing, ACROSS accounts. It does look like they stopped that practice, but it caused quite a stir at the time So if you uploaded a ubuntu ISO and so did I, they were simply linked. This may have been disabled. They specifically advertised stuff like this wasn't being done, but turns out it was "mis-communicated". FTC complaints were even filed i believe over this. [1] The Snowden leaks revealed the encryption they used allowed Dropbox to decrypt and surrender files to third parties. Though this was widely know and the workaround had long been to encrypt a container and store it in dropbox to mitigate this and the de-duplication issues etc. They also have a tendency to strip/remove files/code they deem malicious in nature. So anything netsec related was at risk for me. Things like shell scripts etc. They actually say this is a feature, but its pretty heavy handed Not sure if that is the current behavior because due to these things i ditched them years ago and never looked back. I mostly roll my own with things like this now anyway. The only time i use a "cloud" service like this is to share something with the understood privacy risks. [1]https://web.archive.org/web/20121020152158/http://www.informationweek.com/storage/security/dropbox-accused-of-misleading-customers/229500683 https://web.archive.org/web/20121020152158/http://www.inform...

seoaeu 5y ago
None of the points seem all that bad to me, though I can see that their security mechanisms could cause issues if you're doing netsec. For instance is wrong with de-duplicating files on the backend provided they use a strong enough hash algorithm to avoid hash collisions?
- jlokier 5y ago
  If it's only on the backend, a timing attack could still potentially estimate whether particular content is already on the system. Protection against subtle timing attacks on deduplication is difficult.
beermonster 5y ago
I used to have a mountable VeraCrypt file system image in my Dropbox to mitigate just these types of things. That was when Dropbox first started. I now have no need for Dropbox at all so no longer have an account. These days their are also lots of FOSS alternatives too.

sneak 5y ago

Dropbox isn't private. Lacking e2e encryption, everything you store on Dropbox is available to Dropbox staff as well as anyone who can coerce them.