3 ms·

Interesting. It seems like there are two separate issues here: (1) Dropbox is inconsistent about whether it ignores dots in the local part of an email address

Interesting. It seems like there are two separate issues here: (1) Dropbox is inconsistent about whether it ignores dots in the local part of an email address, and in some cases blurs the line between accounts with similar emails. If true, this needs to be fixed. and (2) Dropbox doesn't really use two-factor authentication, in the usual sense of "something you know plus something you have." I'm guessing this is due to their users liking the idea of having two-factor authentication, but in practice want to be able to access their account even if their phone is lost. So it turns into "something you know plus something you know." I'm inclined to think that this kind of not-really-two-factor-authentication is actually the correct approach for the kind of data you store on Dropbox, but it's something to think about when you're designing an account-recovery protocol.

parfe 13y ago
Your second point isn't correct. The emergency codes are "something you have". You can only generate the codes while logged in, and keep a physical copy separate from your phone. If you lose your phone you pull the paper from your wallet, or get it from a friend or your desk drawer or wherever.
- 6d0debc071 13y ago
  You could say the same of a password - which isn't what people traditionally mean by 'something you have,' e.g. some form of security token which is difficult or impossible to reproduce and of which physical possession is a requirement.
jervisfm 13y ago
Dropbox is a cloud provider that hosts critical information for many people. Given this nature of their business, I'd expect that security is actually their number one primary focus (even beyond new features I'd say). With regards to point number 1, I don't understand how that bug could have existed uncaught. Yes, security is hard but when you're storing the most personal user data, you're obliged to make sure you actually keep it safe and protect it from unauthorized access. Yet, with Dropbox, it appears that every so often that some time goes by, and we have yet another security issue. The worst I remember was when for a window of time, _anyone_ could login to _any_ dropbox user account without entering a valid password. No password. Just a valid username and you're in. It's interesting to note that issue too had to do with authentication and authorization. Maybe it's time Dropbox should spend some time auditing their code to find other similar issues just waiting to be discovered?
- MichaelGG 13y ago
  I would not expect security to rank as their number one thing. Usability is probably the primary, outranking, engineering goal. Security as a prime requirement would place client-side encryption over other goals, which they do not. As you pointed out, dropbox has shown they're not very secure. They lied about their server-side encryption too. But no one cares. It's far more profitable to make a reasonable pass at security, then try to deliver on the user experience and marketing.
  - rdl 13y ago
    They're sufficiently bad at security that I actively discourage people from using Dropbox for anything but personal toy stuff. Since their future revenue expansion seems to be tied to "dropbox for teams", not fixing security is a major problem for them, since any competent auditor would have similar concerns about dropbox (not just "dropbox can see your files", but the other access controls and auditing/logging dropbox doesn't support.) Box also sucks for security, but slightly less. Everyone I know in a security-conscious environment uses something else. Sadly, often MS Sharepoint. There are some big advantages to a system like Dropbox, but aside from some small startups, nothing in that space I'd actually recommend for business use.
    - cybspi 13y ago
      There are more security conscious applications that have usability better than sharepoint, take for instance adeptCloud, it works pretty much like dropbox but the backing store of data is on the business premise instead of in S3.

parfe 13y ago

Your second point isn't correct. The emergency codes are "something you have". You can only generate the codes while logged in, and keep a physical copy separate from your phone. If you lose your phone you pull the paper from your wallet, or get it from a friend or your desk drawer or wherever.

6d0debc071 13y ago
You could say the same of a password - which isn't what people traditionally mean by 'something you have,' e.g. some form of security token which is difficult or impossible to reproduce and of which physical possession is a requirement.

jervisfm 13y ago

Dropbox is a cloud provider that hosts critical information for many people. Given this nature of their business, I'd expect that security is actually their number one primary focus (even beyond new features I'd say). With regards to point number 1, I don't understand how that bug could have existed uncaught. Yes, security is hard but when you're storing the most personal user data, you're obliged to make sure you actually keep it safe and protect it from unauthorized access. Yet, with Dropbox, it appears that every so often that some time goes by, and we have yet another security issue. The worst I remember was when for a window of time, _anyone_ could login to _any_ dropbox user account without entering a valid password. No password. Just a valid username and you're in. It's interesting to note that issue too had to do with authentication and authorization. Maybe it's time Dropbox should spend some time auditing their code to find other similar issues just waiting to be discovered?

MichaelGG 13y ago
I would not expect security to rank as their number one thing. Usability is probably the primary, outranking, engineering goal. Security as a prime requirement would place client-side encryption over other goals, which they do not. As you pointed out, dropbox has shown they're not very secure. They lied about their server-side encryption too. But no one cares. It's far more profitable to make a reasonable pass at security, then try to deliver on the user experience and marketing.
- rdl 13y ago
  They're sufficiently bad at security that I actively discourage people from using Dropbox for anything but personal toy stuff. Since their future revenue expansion seems to be tied to "dropbox for teams", not fixing security is a major problem for them, since any competent auditor would have similar concerns about dropbox (not just "dropbox can see your files", but the other access controls and auditing/logging dropbox doesn't support.) Box also sucks for security, but slightly less. Everyone I know in a security-conscious environment uses something else. Sadly, often MS Sharepoint. There are some big advantages to a system like Dropbox, but aside from some small startups, nothing in that space I'd actually recommend for business use.
  - cybspi 13y ago
    There are more security conscious applications that have usability better than sharepoint, take for instance adeptCloud, it works pretty much like dropbox but the backing store of data is on the business premise instead of in S3.