3 ms·

I agree with most of your points, but why not encrypt sensitive information yourself before it gets uploaded/shared on your dropbox account? Sure, it's not end

I agree with most of your points, but why not encrypt sensitive information yourself before it gets uploaded/shared on your dropbox account? Sure, it's not end to end encryption but it prevents the company from using the encrypted data as a training corpus.Are shared folders and files created by co-workers and family not tech savvy enough to know about encryption?

bugglebeetle 3y ago
I agree this is a good practice, but if you have to do this to defend yourself against the rogue actions of a service you’re paying for, you’re probably better off not suing the service.
- foobiekr 3y ago
  Different services have different and unclear expectations. For example, you'd imagine that a big online storage service would have some access controls in place to limit what uploaded data random employees in operations and engineering can see, but in at least one case you'd be totally wrong. This strikes me as a perfectly reasonable expectation - the data isn't just sitting there exposed to arbitrary employees and that only trusted employees have that kind of access, and not broadly. I don't think this is rogue actions, I think it falls into the category of perfectly reasonable expectations that are not actually met by a wide variety of cloud services.
k_process 3y ago
Because Dropbox acquired Boxcryptor -- one of the tools that easily let people encrypt files before upload -- to be replaced with "plans for end-to-end encryption" https://techcrunch.com/2022/11/29/dropbox-acquires-boxcryptor-assets-to-bring-zero-knowledge-encryption-to-file-storage https://techcrunch.com/2022/11/29/dropbox-acquires-boxcrypto...
klabb3 3y ago
> Sure, it's not end to end encryption Nit, but what you’re describing is e2ee (except for the metadata). If you encrypt your files before uploading and decrypt it only locally then only the logical sender and recipient have access. That it goes through Dropbox is not important (and also the beauty of e2ee). This is a bit unusual, otherwise it’s typically people (and shady service providers) who say that something is e2ee when it isn’t.

bugglebeetle 3y ago

I agree this is a good practice, but if you have to do this to defend yourself against the rogue actions of a service you’re paying for, you’re probably better off not suing the service.

foobiekr 3y ago
Different services have different and unclear expectations. For example, you'd imagine that a big online storage service would have some access controls in place to limit what uploaded data random employees in operations and engineering can see, but in at least one case you'd be totally wrong. This strikes me as a perfectly reasonable expectation - the data isn't just sitting there exposed to arbitrary employees and that only trusted employees have that kind of access, and not broadly. I don't think this is rogue actions, I think it falls into the category of perfectly reasonable expectations that are not actually met by a wide variety of cloud services.

k_process 3y ago

Because Dropbox acquired Boxcryptor -- one of the tools that easily let people encrypt files before upload -- to be replaced with "plans for end-to-end encryption" https://techcrunch.com/2022/11/29/dropbox-acquires-boxcryptor-assets-to-bring-zero-knowledge-encryption-to-file-storage https://techcrunch.com/2022/11/29/dropbox-acquires-boxcrypto...

klabb3 3y ago

> Sure, it's not end to end encryption Nit, but what you’re describing is e2ee (except for the metadata). If you encrypt your files before uploading and decrypt it only locally then only the logical sender and recipient have access. That it goes through Dropbox is not important (and also the beauty of e2ee). This is a bit unusual, otherwise it’s typically people (and shady service providers) who say that something is e2ee when it isn’t.