4 ms·
On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for
by steven777400 13y ago
On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance).
On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human, whether through deliberate management direction or mischief, is opening all these documents. I would more concerned about human intervention if occasionally, a document triggered a buzz some days after it had been uploaded.
If all documents are showing as opened within 10 minutes, then surely it is just an anti-duplication automated agent at work.
- blcknight 13y agoI just tried this with a doc file, and the buzz was nearly instantaneous, within seconds -- 3 buzzes total. Certainly it's automated. Paranoid part of me says it's NSA keyword scanning. I feel a little insane suggesting that, but it's certainly conceivable these days. The other possibility is Dropbox is indexing the files for search? Anyway, using Dropbox unecrypted is a terrible idea. EncFS has user-friendly frontends like Boxcryptor.
- gjulianm 13y agoKeyword scanning shouldn't resolve images, unless they're using OCR to read any text they have. In that case, they'd be wasting a lot of resources.
- blcknight 13y agoWhere do you get that this is using images? Honey Docs doesn't actually explain what the callback looks like in the doc file, but it doesn't look like it has anything to do with images.
- mkopinsky 13y agoThe HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the HTML in those files to fetch the image (a 1px gif). I downloaded the credit card Honeydoc. The content looks like: <html>Nicole Davis 4556062729618215<br /> Brian Baker 4556767839126624<br /> Patrick Jones 4916615717158539<br /> .... <br> <br> <br> .... <img src="https://honeydocs.herokuapp.com/img/html/202719bb5717d5621068780180abc593b0fedda692bd63727a510911d21fdcbf.gif"> </html>
- mkopinsky 13y agoOh, and FTR, Excel gives a warning before opening the file. So they at least have thought through this vector (if you want to call it that).
- 0x0 13y agoMany XML parsers will resolve external entities by default.
- rgbrenner 13y agoIf all documents are showing as opened within 10 minutes, then surely it is just an anti-duplication automated agent at work. It could perhaps be from generating a thumbnail... But dedup wouldn't work like that.. I would be very concerned about a dedup algo that requires interpreting the contents of a file, and dedup'ing based on that.
- BWStearns 13y agoDedup could just use hashing which wouldn't require opening the file with Libreoffice.
- rgbrenner 13y agoMost dedup algos do compare the data. If you just use the hash, there's a very small chance of a hash collision causing file corruption / data loss. And depending on how common that block is, the corruption could affect a large number of files. Its a byte comparison.. so you still wouldn't use libreoffice to compare files.
- snowwrestler 13y agoAs I read it, the whole point of the "HoneyDoc" concept is that any access to the file generates a GET request. In other words it is specially crafted to ensure external resource retrieval. Understanding the nature of the DropBox access would start with understanding how a "HoneyDoc" does what it claims it does.