4 ms·

One of Dropbox's biggest disadvantages for "teams" is the way it handles transitive sharing. If I share "Folder A" with Alice, then she can re-share it with Bob

by gcv 15y ago

One of Dropbox's biggest disadvantages for "teams" is the way it handles transitive sharing. If I share "Folder A" with Alice, then she can re-share it with Bob without my permission. I can see that she has done this through the web UI, but I'd have to explicitly look at the list of users with access to the shared folder. Reading the "Dropbox for Teams" FAQ, I don't see if this problem has been fixed. It seems pretty essential for a lot of "team" functionality.

kristaps 15y ago
Should teams have secrets among themselves?
- gcv 15y ago
  Suppose I'm on a team with Alice, and I share a folder with her. Bob is not on our team. Alice can share one of my folders with Bob without my consent. This is a problem (consider dealing with temporary employees, contractors, and so on). In addition, some teams really need separation of knowledge. Perhaps I have some financial or contract files which most of my employees should not read, but I want to share them with my accountant and my lawyer. This feature reeks of "enterpriseyness", so I understand that Dropbox probably doesn't want to deal with it, but it is valuable to small businesses as well.
  - joesb 15y ago
    If Alice wants to, she can always copy the file out of the team's dropbox folder and email it to Bob.
    - deleted 15y ago
      [deleted]
    - guan 15y ago
      … or copy it to her personal Dropbox, then share that folder with Bob. It would probably be superfast because of Dropbox’s deduplication.
    - jamesrcole 15y ago
      It's not as simple as that. Sure, she can do that if all she wants to do is copy it once. But what if the folder's contents are frequently being changed and she wants to keep Bob abreast of them? If files in it are being changed, and new ones are added? Then she has to make the effort to track changes and repeatedly email them to Bob. It's a matter of the amount of friction involved, and there can be a big difference in friction between being able to share-by-copy things and just giving access to the folder.
  - lotu 15y ago
    And if you were using paper Alice could photocopy the document and hand it Bob. The answer to this problem is Alice needs to know who this information can and cannot be shared with. If she isn't capable of that these permissions won't help anyways.
    - gcv 15y ago
      There is a difference between the effort of photocopying individual documents and sending them along one by one, and getting them automatically synced to my competitors. Just because an employee can copy out all files does not make it acceptable for software to re-share out confidential data without so much as sending a notification to the owner. There's no such thing as perfect security, but raising the bar and making malicious behavior more difficult is not a bad thing, especially when it improves the UX.
      - div 15y ago
        Dropbox is in the business of enabling stuff, not disabling malicious behaviour (or making it more difficult or whatever). Specifically, if someone has malicious intent, software is not likely to stop them. You can't solve people problems with software is a often used mantra.
  - sixothree 15y ago
    Does this mean Bob would be able to alter documents you never explicitly shared with him?
    - gcv 15y ago
      Yes, Bob has full access. Dropbox does not support read-only sharing. The nightmare scenario is: (1) Alice re-shares my folder with Bob, and I don't know about it. (2) I don't have the "preserve modifications infinitely" option turned on in my Dropbox account. (3) Bob starts to make malicious changes to my files. (4) I discover this more than 30 days later, which means I can't recover the original files.
- Duff 15y ago
  In many cases, they need to. At the end of the day, Dropbox can do whatever it wants, but that feature basically eliminated many potential customers from ever using it.
jcampbell1 15y ago
> If I share "Folder A" with Alice, then she can re-share it with Bob without my permission. Email works the same way. I think transitive sharing what people expect. The alternative is: "You can see and edit files in this folder, but if you want to share it with someone else, you must duplicate it and then share the copy."
- philipDS 15y ago
  Yes, email works the same, but there is a small difference in persistence. Probably the folder you shared with Alice will be used for multiple files in the future, while an email is probably used to mail a single file or just a few files. Okay, as soon as I note that Alice shared the folder with Bob, I can stop using it.. but what's the point in that?
baddox 15y ago
If Alice has access to files, she can share them through any means with anyone she likes (email, another file-sharing service, etc.). I guess you're just suggesting that Dropbox make it a bit harder to do so through their service, but the actual problem is unsolvable and requires some mutual trust in your team.

by gcv 15y ago

kristaps 15y ago

Should teams have secrets among themselves?

gcv 15y ago
Suppose I'm on a team with Alice, and I share a folder with her. Bob is not on our team. Alice can share one of my folders with Bob without my consent. This is a problem (consider dealing with temporary employees, contractors, and so on). In addition, some teams really need separation of knowledge. Perhaps I have some financial or contract files which most of my employees should not read, but I want to share them with my accountant and my lawyer. This feature reeks of "enterpriseyness", so I understand that Dropbox probably doesn't want to deal with it, but it is valuable to small businesses as well.
- joesb 15y ago
  If Alice wants to, she can always copy the file out of the team's dropbox folder and email it to Bob.
  - deleted 15y ago
    [deleted]
  - guan 15y ago
    … or copy it to her personal Dropbox, then share that folder with Bob. It would probably be superfast because of Dropbox’s deduplication.
  - jamesrcole 15y ago
    It's not as simple as that. Sure, she can do that if all she wants to do is copy it once. But what if the folder's contents are frequently being changed and she wants to keep Bob abreast of them? If files in it are being changed, and new ones are added? Then she has to make the effort to track changes and repeatedly email them to Bob. It's a matter of the amount of friction involved, and there can be a big difference in friction between being able to share-by-copy things and just giving access to the folder.
- lotu 15y ago
  And if you were using paper Alice could photocopy the document and hand it Bob. The answer to this problem is Alice needs to know who this information can and cannot be shared with. If she isn't capable of that these permissions won't help anyways.
  - gcv 15y ago
    There is a difference between the effort of photocopying individual documents and sending them along one by one, and getting them automatically synced to my competitors. Just because an employee can copy out all files does not make it acceptable for software to re-share out confidential data without so much as sending a notification to the owner. There's no such thing as perfect security, but raising the bar and making malicious behavior more difficult is not a bad thing, especially when it improves the UX.
    - div 15y ago
      Dropbox is in the business of enabling stuff, not disabling malicious behaviour (or making it more difficult or whatever). Specifically, if someone has malicious intent, software is not likely to stop them. You can't solve people problems with software is a often used mantra.
- sixothree 15y ago
  Does this mean Bob would be able to alter documents you never explicitly shared with him?
  - gcv 15y ago
    Yes, Bob has full access. Dropbox does not support read-only sharing. The nightmare scenario is: (1) Alice re-shares my folder with Bob, and I don't know about it. (2) I don't have the "preserve modifications infinitely" option turned on in my Dropbox account. (3) Bob starts to make malicious changes to my files. (4) I discover this more than 30 days later, which means I can't recover the original files.
Duff 15y ago
In many cases, they need to. At the end of the day, Dropbox can do whatever it wants, but that feature basically eliminated many potential customers from ever using it.

jcampbell1 15y ago

> If I share "Folder A" with Alice, then she can re-share it with Bob without my permission. Email works the same way. I think transitive sharing what people expect. The alternative is: "You can see and edit files in this folder, but if you want to share it with someone else, you must duplicate it and then share the copy."

philipDS 15y ago
Yes, email works the same, but there is a small difference in persistence. Probably the folder you shared with Alice will be used for multiple files in the future, while an email is probably used to mail a single file or just a few files. Okay, as soon as I note that Alice shared the folder with Bob, I can stop using it.. but what's the point in that?

baddox 15y ago

If Alice has access to files, she can share them through any means with anyone she likes (email, another file-sharing service, etc.). I guess you're just suggesting that Dropbox make it a bit harder to do so through their service, but the actual problem is unsolvable and requires some mutual trust in your team.