4 ms·

This has been done and the exploit has been (mostly?) closed. Google "dropship" for all the details.

• gibybo 14y ago
  How does their dedupe method work now? Shouldn't it still be possible under the same principle?
  • kirubakaran 14y ago
    Client: I have the file with hash 0x47fed9. Server: Okay, tell me what byte 1257 (randomly chosen) of that file is and I'll mark you as having the file. Client: Ummm ...
    • z92 14y ago
      The way you said it is x100 times better than just explaining it.
      • kirubakaran 14y ago
        Thank you
        • 0x0 14y ago
          Do they ask for exactly one random byte for every 4mb hashed block? For a <4mb file, if you just guessed a random byte and try 256 times, wouldn't you probably get it right at least once? Still, they could easily change the scheme to ask for more bytes to reduce the chance of a correct guess, plus it would be hopeless for large files.
          • ringm 14y ago
            They could give you a sufficiently long random salt and ask you to calculate the hash of the salt and block contents. This scheme seems to be secure.
    • invisible 14y ago
      So a client could theoretically talk to another client that knows what byte 1257 is and the file would appear to answer what the question implied.
      • tincholio 14y ago
        I think you missed the part where byte 1257 was "randomly chosen"
        • icebraining 14y ago
          It depends. If I already have the full file, it's much easier (and efficient) to tell you the value of a random byte and let DB give you the file than having to transfer it all.
          • tincholio 14y ago
            Of course, but then you still need infrastructure to figure out who else has the file, how to keep things private, etc. You can't just distribute a hash and be done with it.
          • lazerwalker 14y ago
            If you're dealing on a small scale (e.g. "Hey, icebraining, let me grab that file from you!"), it's going to be easier to just send a share request from your Dropbox account to mine, which has the same end result (flipping an ownership bit in Dropbox's system). That doesn't really scale, no, but sharing hashes doesn't really either, unless you want to spend a significant amount of time building infrastructure to keep track of who has what files and automate the management of sharing hashes.
        • invisible 14y ago
          I didn't miss that part, I was simply saying that a client that had the file could tell what byte 1257 was to the other client (or some other random byte, as requested by dropbox).
      • jgeralnik 14y ago
    • Maro 14y ago
      So I forward the request to a peer who has the file, he tells me the answer, and bam. Doesn't the BT protocol allow the download of small segments of a file?
      • reacweb 14y ago
        Yes and it is a win win result: you have proved that you have access to the file, so dropbox has only optimized bandwidth.
    • CraigRood 14y ago
      How long does it wait for an answer? Basic maths will allow you to work out what Chunk is required from the torrent swarm to get the answer pretty quickly.
    • kgen 14y ago
      Clever...
• brooksbp 14y ago
  Google "dropship dropbox". Googling "dropship" wont get you anywhere.