5 ms·
I think your article glosses over the fact that we have privacy concerns beyond training on my data. I'm a working professional and I have clients that are gov
by daft_pink 3y ago
I think your article glosses over the fact that we have privacy concerns beyond training on my data.
I'm a working professional and I have clients that are governed by confidentiality agreements and regulations regarding where information goes, and I would just prefer using a service where my data rests on a server instead of having more and more points for a data breach to be introduced.
I don't really understand why my data isn't fully encrypted at all times and only I can view it in the first place, but the idea that they are actively sending it across the internet to be ingested by other companies and processed without my consent or interest is so terrible.
I often use AI features when I opt into them, but having a company just sending my personal files all over the internet without my consent is insanity.
Honestly, OneDrive has a migration tool and I got a trial for dropbox business and moved all my files automatically last night. It's just the last straw in their company constantly doing things I don't ask them to do like introducing crap and popups into my desktop interface and never offering the feature I constantly ask for... end to end encryption.
If you want a couple click migration from Dropbox Business to an Office 365 Onedrive account, it's right here: https://learn.microsoft.com/en-us/sharepointmigration/mm-dropbox-overview https://learn.microsoft.com/en-us/sharepointmigration/mm-dro...
- satya71 3y agoIs OneDrive end-to-end encrypted? I think Microsoft will introduce a similar feature soon, if they haven’t already.
- daft_pink 3y agoNope, but it just makes sense as a quick and easy stopgap measure until I find time to figure out who to use, because it's easily compatible with my mac and pc, I already pay for a subscription so it saves money, it can run without putting all the files on every machine that I own, they aren't sending my info everywhere. If anyone has suggestions on a reliable end-to-end encrypted solution with a lightweight cross platform sync software that doesn't force you to download all the files to your device (my Mac's HD is too small) and is generally fully featured. That won't take very much time to migrate with a trustworthy migration vendor. I'm willing to pay a premium price for it and I'm all ears.
- aborsy 3y agoThere are several: iCloud, ProtonDrive, Sync.com, etc.
- daft_pink 3y agoiCloud isn't cross platform enough ProtonDrive is going to pull down every file to every device and act in a dumb way Sync might be a good choice actually. I have to investigate them further
- ls612 3y agoiCloud with Advanced Data Protection turned on is the only one I know of. And it’s obviously Mac only.
- wrs 3y agoThey’ve already announced “M365 Copilot”, which is in the same ballpark as the Dropbox features (ask questions about your documents, etc.), and of course uses OpenAI like Dropbox does. So the only real difference here would be trust.
- bugglebeetle 3y agoI would imagine it doesn’t use OpenAI’s servers, but their hosted versions of OpenAI’s technology though right? Like whatever they’re currently selling to enterprise customers via Azure?
- wrs 3y agoI don’t really know the structure there. Does OpenAI actually have servers? Or do they use Azure servers?
- felixfbecker 3y agoiCloud Files is the only major cloud file syncing service that is e2e encrypted afaik. Was my reason to migrate over from OneDrive (especially since I was already using Apple devices and paying for iCloud for photos anyway).
- daft_pink 3y agoThanks! I would use iCloud, but I have a few windows devices I need for work unfortunately. It doesn't let me use the advanced security and maintain a windows device. Ironically, like many of these services I already have an Apple One subscription and am paying for it anyways.
- JohnFen 3y agoCan you trust anyone who claims that things are end-to-end encrypted? Microsoft could take the point of view that you are one "end" and DropBox is the other "end". If they encrypt the data in transit and decrypt it on their end, it's still technically "end-to-end encrypted". They could also just lie. Having a company claim end-to-end encryption still means that I have to trust that the company isn't being sleazy. The only encryption you can really have some measure of trust in is the encryption you apply yourself.
- nonrandomstring 3y agoWhat you're describing is a deeper problem not only with "AI" but with the entire cloud-centric side of the tech world. Homomorphic encryption might save the day for delocalised computing but we're some years away from that being a reality. Meanwhile de-clouding, "repatriation" to on-prem and hybrid private cloud cooperatives within a trusted group are how we get there. Another good reason is simply to stem the enormous wealth transfer to big-data from individuals and smaller companies. I'm glad to see that fantasies about omniscient AI taking over the world are giving way to a better grasp of the more mundane realities; AI just accelerating the already obscene power imbalances present in our world. Keep your private stuff private.
- daft_pink 3y agoYeah, the problem is that I just need something quick and easy. I'm not an idealist. I just need something simple that checks most of the boxes and works easily across my blended eco-system of devices. It's why I use dropbox to begin with.
- nonrandomstring 3y agoI get you, but when you say "sending my personal files all over the internet without my consent is insanity", that sounds like pretty strong affect. Maybe it's time you re-evaluated your choice for expediency and ease in tension with something sane you believe in. In today's world just championing sanity is already an "ideology" :)
- lesostep 3y agoI really do genuinely think is that at the core the is problem that it's very hard to address your real computer from the Internet. There are programs that effortlessly can make a directory on your PC into the quite secure "cloud". Windows lets you share a password-protected directory right out of the box! It is that easy to buy a few Tb disk and just run a program, if not for the: 1. Routers that doesn't allow easy port forwarding (or even ban certain ports) 2. Dynamic IPs 3. People selling domains pushing their own VPS services. 4. The amount of steps you have to take to allow A lot of small organizations I know didn't need a system administrators to configure and run programs like this. A lot of them are beginner friendly! They needed them to configure the network. Same applies for self-hosting sites. If there was a program that just hosted on your PC address any html-page you put into it, a lot of people would self-host something. But you can't unless you can wrangle your router and figure out how to buy static IP – two tasks that are way harder than basic html. The stack for easy and secure self-hosting is here, but the network changed too much. Hopefully, ipv6 will help to solve this problem.
- emporas 3y agoI agree with most of your points, but why not encrypt sensitive information yourself before it gets uploaded/shared on your dropbox account? Sure, it's not end to end encryption but it prevents the company from using the encrypted data as a training corpus.Are shared folders and files created by co-workers and family not tech savvy enough to know about encryption?
- bugglebeetle 3y agoI agree this is a good practice, but if you have to do this to defend yourself against the rogue actions of a service you’re paying for, you’re probably better off not suing the service.
- foobiekr 3y agoDifferent services have different and unclear expectations. For example, you'd imagine that a big online storage service would have some access controls in place to limit what uploaded data random employees in operations and engineering can see, but in at least one case you'd be totally wrong. This strikes me as a perfectly reasonable expectation - the data isn't just sitting there exposed to arbitrary employees and that only trusted employees have that kind of access, and not broadly. I don't think this is rogue actions, I think it falls into the category of perfectly reasonable expectations that are not actually met by a wide variety of cloud services.
- k_process 3y agoBecause Dropbox acquired Boxcryptor -- one of the tools that easily let people encrypt files before upload -- to be replaced with "plans for end-to-end encryption" https://techcrunch.com/2022/11/29/dropbox-acquires-boxcryptor-assets-to-bring-zero-knowledge-encryption-to-file-storage https://techcrunch.com/2022/11/29/dropbox-acquires-boxcrypto...
- klabb3 3y ago> Sure, it's not end to end encryption Nit, but what you’re describing is e2ee (except for the metadata). If you encrypt your files before uploading and decrypt it only locally then only the logical sender and recipient have access. That it goes through Dropbox is not important (and also the beauty of e2ee). This is a bit unusual, otherwise it’s typically people (and shady service providers) who say that something is e2ee when it isn’t.
- layer8 3y agoThe better solution is to use a separate encryption overlay like Cryptomator over whatever cloud storage you use. If you have confidentiality agreements with clients, you shouldn’t be using Dropbox without E2EE anyway, nor OneDrive.
- daft_pink 3y agoIs it going to work on my iPad or iPhone? How long is it going to take? I tried to research that once, but it looked like Dropbox bought whatever service worked well and no longer seemed like a good solution. I would prefer the service to just work out of the box.
- layer8 3y agoYes, it works on iOS [0]. Personally I’m still using the standalone mode of Boxcryptor (the iOS app is still receiving updates), which unfortunately was bought up by Dropbox, and in the past there were opinions that it worked better than Cryptomator, but many people seem to be happy with Cryptomator now, so I’d give it a shot. [0] https://apps.apple.com/us/app/cryptomator-2/id1560822163 https://apps.apple.com/us/app/cryptomator-2/id1560822163
- willmadden 3y agoI found solutions like Boxcryptor cumbersome to use. Unless you stored the data redundantly locally, you had to download big encrypted files in order to access a small file. Also searching files was impossible unless you downloaded everything, decrypted it, and searched locally. I quickly realized it was adding huge delays in my day-to-day work and a lot of stress during time-sensitive tasks. Have these e2ee overlays improved in usability since then?
- layer8 3y agoObviously you can’t search contents in encrypted state, and with E2EE this means that server-side search is not possible. I rarely use indexed file contents search (filename search is usually enough and that works well, and tools like grep work transparently), however the Boxcryptor drive can be added to the Windows Search Index (or whatever search software you use), and I assume it’s similar on Mac. You don’t have to decrypt manually. Indexing causes more system load due to the necessary decryption, of course. On desktop systems I always store all relevant data locally, exactly for the redundancy. I’m not sure what you mean by “big encrypted files”, because each original file is encrypted individually and thus has basically the same size as the original.
- pimterry 3y agoI moved to Mega recently, who now have a very tidy full E2EE cloud storage dropbox equivalent: https://mega.io/storage https://mega.io/storage. No affiliation, but it does exactly what you're asking for, and I've been very happy with it.
- sorokod 3y agoNeat, can you share a link to "Privacy and Data Policy" they mention?
- daft_pink 3y agoI'm a little bit scared of using Mega, because it's linked to Kim Dot Com, a wanted fugitive and Megaupload used to be known for hosting tons of pirated files. I know they have a cheap solution, but it's not exactly something that checks my box for stability and high character for hosting my very important files.
- simonw 3y agoI thought that too, but according to Wikipedia Kim Dot Com "severed all ties with the service in 2015". https://en.wikipedia.org/wiki/Kim_Dotcom https://en.wikipedia.org/wiki/Kim_Dotcom
- kilolima 3y agoDidn't he also claim that the new Mega was Chinese malware?
- red-iron-pine 3y agoit may be, but the dude isn't exactly know for credibility or integrity
- stavros 3y agoWhich somehow makes it even worse for me, now I suspect it's some sort of honeypot.
- bastardoperator 3y agoDropbox issued this statement literally yesterday: "If you’ve used any of Dropbox’s AI tools, some of your documents and files may have been temporarily shared with OpenAI." Good luck thinking a cloud provider has YOUR best interest at heart. This is Hacker News, I feel like trust should be earned, never implied.
- pavel_lishin 3y agoThat word, "temporarily", is doing a lot of heavy lifting in a digital world where things can be duplicated for free.
- bastardoperator 3y agoSeems like an s3 bucket would have been a better alternative. We have no idea what OpenAI does with Dropbox customer data outside of storing it for 30 days. They're doing something, basically all Dropbox customer files with get propagated to OpenAI by default and that should be scary, not feel good. Dropbox’s practices aren’t unprecedented, but customer documents do pass through OpenAI’s servers and are stored there for up to 30 days, and the “third-party AI” toggle is turned on by default in account settings.
- simonw 3y agoWhat makes you think this is about "basically all Dropbox customer files"?
- bastardoperator 3y agoTurning on AI by default seems to indicate they're sending your data somewhere automatically before seeking approval or opt-in. I could be very wrong, but the wording alone would at the very least make me cautious.
- skywhopper 3y agoIf it’s turned on by default and one of its capabilities is to use AI to search your files, then why wouldn’t we assume it applies to basically all files? How could it not?
- bad_user 3y agoI very much agree with you, however, do you really think that Microsoft, of all companies, isn't using your data for training LLMs, with all the data leakage risks? What makes you think that your data is safer on OneDrive? Bing Chat (based on ChatGPT), Copilot, etc. As a GitHub user, I never got a checkbox to opt-out of GitHub Copilot's training on my code. At least Dropbox provides a checkbox.
- bsenftner 3y agoI've worked for multiple department of defense contractors where they have their entire code base, to the tune of a few dozen terabytes - including highly sensitive ML training data - in their dropbox accounts. I bet they are in full panic.
- boh 3y agoI wouldn't have much faith in OneDrive either. Just use Cryptomator for everything.
- deleted 3y ago[deleted]