4 ms·

Dropbox is a cloud provider that hosts critical information for many people. Given this nature of their business, I'd expect that security is actually their num

Dropbox is a cloud provider that hosts critical information for many people. Given this nature of their business, I'd expect that security is actually their number one primary focus (even beyond new features I'd say). With regards to point number 1, I don't understand how that bug could have existed uncaught. Yes, security is hard but when you're storing the most personal user data, you're obliged to make sure you actually keep it safe and protect it from unauthorized access. Yet, with Dropbox, it appears that every so often that some time goes by, and we have yet another security issue. The worst I remember was when for a window of time, _anyone_ could login to _any_ dropbox user account without entering a valid password. No password. Just a valid username and you're in. It's interesting to note that issue too had to do with authentication and authorization. Maybe it's time Dropbox should spend some time auditing their code to find other similar issues just waiting to be discovered?

MichaelGG 13y ago
I would not expect security to rank as their number one thing. Usability is probably the primary, outranking, engineering goal. Security as a prime requirement would place client-side encryption over other goals, which they do not. As you pointed out, dropbox has shown they're not very secure. They lied about their server-side encryption too. But no one cares. It's far more profitable to make a reasonable pass at security, then try to deliver on the user experience and marketing.
- rdl 13y ago
  They're sufficiently bad at security that I actively discourage people from using Dropbox for anything but personal toy stuff. Since their future revenue expansion seems to be tied to "dropbox for teams", not fixing security is a major problem for them, since any competent auditor would have similar concerns about dropbox (not just "dropbox can see your files", but the other access controls and auditing/logging dropbox doesn't support.) Box also sucks for security, but slightly less. Everyone I know in a security-conscious environment uses something else. Sadly, often MS Sharepoint. There are some big advantages to a system like Dropbox, but aside from some small startups, nothing in that space I'd actually recommend for business use.
  - cybspi 13y ago
    There are more security conscious applications that have usability better than sharepoint, take for instance adeptCloud, it works pretty much like dropbox but the backing store of data is on the business premise instead of in S3.

MichaelGG 13y ago

I would not expect security to rank as their number one thing. Usability is probably the primary, outranking, engineering goal. Security as a prime requirement would place client-side encryption over other goals, which they do not. As you pointed out, dropbox has shown they're not very secure. They lied about their server-side encryption too. But no one cares. It's far more profitable to make a reasonable pass at security, then try to deliver on the user experience and marketing.

rdl 13y ago
They're sufficiently bad at security that I actively discourage people from using Dropbox for anything but personal toy stuff. Since their future revenue expansion seems to be tied to "dropbox for teams", not fixing security is a major problem for them, since any competent auditor would have similar concerns about dropbox (not just "dropbox can see your files", but the other access controls and auditing/logging dropbox doesn't support.) Box also sucks for security, but slightly less. Everyone I know in a security-conscious environment uses something else. Sadly, often MS Sharepoint. There are some big advantages to a system like Dropbox, but aside from some small startups, nothing in that space I'd actually recommend for business use.
- cybspi 13y ago
  There are more security conscious applications that have usability better than sharepoint, take for instance adeptCloud, it works pretty much like dropbox but the backing store of data is on the business premise instead of in S3.