7 ms·

The Tech Behind Dropbox’s New User Experience on Mobile, Part 2

81 points by tweakz 12y ago

deleted 12y ago
[deleted]
- vdaniuk 12y ago
  I've been monitoring HN reactions to Dropbox news with interest and I can conclude that mentioning Rice in comments has fallen out of vogue and is punished with downvotes of power users. HN was outraged at first, now it's meh about the whole deal. A regrettable development that shows companies that one can easily alienate a part of its early adopters, but bad rep won't stick if you continue to ship shiny things.
  - bronson 12y ago
    Gotta wonder about Dropbox and HN both being YC projects... Think that helps Rice be a non-issue?
    - dang 12y ago
      Certainly not in any way that I'm aware of.
      - okpl 12y ago
        "...while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec." quite an intriguing attack surface for mobile malware...arbitrary code of Dropbox's choosing when combined with an 0day or two?
      - deciplex 12y ago
        Unfortunately, we have to take your word for it, because there is no transparency of which of the various uncountable "bans" are associated with your account, to say nothing of why they are put there in the first place. You're probably not punishing posters for reminding people that Dropbox is an enthusiastic supporter of illegal domestic NSA spying operations, but there is no way to know that, either. Trust, but verify^H^H^H^H^H^H^H^H^H^H in other words.
      - vdaniuk 12y ago
        Really? Care to tell us why the okpl user is already hell banned after posting 2 comments in this thread criticizing Dropbox and Rice involment?
        dang 12y ago
        Oh my hot-headed, un-Bayesian friends: do you really think we'd be so dumb as to ban people for criticizing Dropbox and Rice after just saying we don't do that? That would be the I Do Not Freebase Cocaine of website moderation [1]. Comments posted from Tor IP addresses by new accounts are killed automatically [2] because of past abuses by trolls. Moderators unkill these when we see them and mark the accounts legit when they're not obviously trolling. I just did that here, even though "Sounds like Condi didn't need much time" is pretty far from a quality comment. Before you seamlessly segue into outrage at that instead, may I mention that we've got a sweet idea for dumping that practice and a truckload of others in a grand devolution of moderation powers to the community. Maybe one day we'll even get to implement it, instead of typing the same comments over and over. Lord and NSA knows it'd be one ginormous headache off our hands. 1. https://www.youtube.com/watch?v=2-ckIv1tiaU https://www.youtube.com/watch?v=2-ckIv1tiaU 2. https://hn.algolia.com/?q=noob+tor#!/comment/sort_by_date/prefix/0/comments%20from%20new%20accounts%20tor https://hn.algolia.com/?q=noob+tor#!/comment/sort_by_date/pr...
        vdaniuk 12y ago
        Nope, I didn't think that you are dumb at all. However, I believe that you have a clear cut conflict of interest that you may not be able to mitigate no matter how hard you try. http://www.ted.com/talks/dan_ariely_beware_conflicts_of_interest http://www.ted.com/talks/dan_ariely_beware_conflicts_of_inte... Also it would be really cool to add [tor noob] fair describing a hellban reason.
ChikkaChiChi 12y ago
Fascinating stuff, but was this a problem in need of a solution? Was Dropbox seeing that many issues with people running the install on their local machine? Were they able to differentiate between those who felt the install was a hassle versus those who simply opted to not install it?
- ksb 12y ago
  There are a lot of places that we were seeing users drop off the radar when trying to install. Through a combination of logging analytics and user studies we figured out what the main problems were and designed this flow to solve them. (See my post from last week for more context on why we built this: https://news.ycombinator.com/item?id=8168792 https://news.ycombinator.com/item?id=8168792)
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - shawn-butler 12y ago
    >> Instead, we created a custom version of the signing tools which complied with the Authenticode spec (for Windows) while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec. >> Can you offer some more info on this topic in a follow-up post?
    - huy2n 12y ago
      Inside the Authenticode signature, there is an area for unauthenticated attributes (e.g., if you timestamped your executable, the timestamp (PKCS#9) is stored as an unauthenticated attribute, http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode.aspx) http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-u...). These attributes are not verified by Windows Authenticode when the executable is run. So if you can add a new unauthenticated attribute into the signature, you can make any change we want to that attribute without invalidate the signature. In order to inject an unauthenticated attribute to the signature, you may want to use osslsigncode for signing (instead of MS signtool).
bzelip 12y ago
The UX of this blog post on mobile (HTC One M8, kit Kat) forces a horizontal scroll to read all of the page's content.
- brianzelip 12y ago
  update: the non-responsive display was due to rendering of the page in the HN mobile app (by Creative Pragmatics) that I use. Visiting the page in a proper browser proved a better experience.
plorg 12y ago
I typically set my browser to clear cookies every session. Is there any provision for such a scenario? The authentication flow seems to suggest that if the browser was closed and cookies cleared, the user would not be allowed to install Dropbox.
- jhurwitz 12y ago
  > If any of our conditions isn’t met, we abort auto sign-in and ask the user to log in with an email and password. In this case, the install succeeds and only auto sign-in fails.
- psychotik 12y ago
  The ultimate fallback always is to revert to letting user sign in manually. Installation success doesn't depend on cookies, so that should be just fine.
jgalt212 12y ago
What's the use case for drop box on mobile devices (other than tablets)?
- jerhinesmith 12y ago
  I use it as online backup for my photos -- the dropbox app syncs them when I'm on wifi.
- darkmirage 12y ago
  Photos and quick viewing of shared documents are common use cases.
- etimberg 12y ago
  I use it with You Need a Budget to sync between my phone and my computers.
mwcampbell 12y ago
I wonder if there are any plans to rewrite the desktop client in C++ (with some Objective-C++ on Mac), presumably using the libdropbox C++ libraries that Dropbox has been developing for the mobile apps, to get the installer size down and leverage more common code across platforms.
- psychotik 12y ago
  Not currently, unfortunately. The complexity of how the Dropbox client works is enough to not pollute libdropbox with at this time. The idea here is correct though - were we to rebuild it at this time, we would look at potentially abstracting a lot things into a libdropbox-like library
  - mike_hearn 12y ago
    I'm surprised you haven't tried harder to optimise the download size ... the blog post says it ships a nearly full Python runtime, but surely you don't actually use it all? The core interpreter is I'd think quite small and Python code should compress very well.
timbre 12y ago
I'm surprised you can sign an executable, then modify it while preserving the validity of the signature, as I always though this is exactly what code signing is meant to prevent. Can anyone who knows more about this than me (a low bar!) explain whether this is a flaw in the signing mechanism or is actually okay?
- NortySpock 12y ago
  From the article: "Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec. We make the tag buffer an unverified section so that the tag buffer can change without having to re-sign the binary." So they sign 90% of the executable, but 10% of it is unsigned.
- chrissnell 12y ago
  More importantly, what good is a code-signed executable when that executable can simply download a payload from the internet like this Dropbox installer does? Code signing seems like a feel-good mechanism for users. Yeah, we guarantee that the executable that you downloaded was signed by a legitimate entity but once you run it, good luck. This type of "meta installer" seems ripe for exploitation. Unscrupulous entities create a legit signed app that later downloads a malicious payload; legitimate distributors might also find themselves to be the target of attackers who want to alter that downloadable payload.
  - timbre 12y ago
    I think the point of code signing is to ensure that the program was really written by Dropbox, so _if_ you trust Dropbox you should trust the program. That trust should definitely include both Dropbox's good intentions and their competency to prevent their payload system from being subverted.
    - deciplex 12y ago
      >That trust should definitely include both Dropbox's good intentions and their competency to prevent their payload system from being subverted. Only a fool would, after their actions of the past year, still believe this company has good intentions or that their payload system hasn't already been totally compromised (with their cooperation, no less).
okpl 12y ago
"...while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec." sounds like Condi didn't need much time for Dropbox to build a nice new home for NSA implants. quite an intriguing attack surface for mobile malware...arbitrary code of Dropbox's choosing when combined with another 0day or two? no thanks. this makes me glad i dropped dropbox like a bad habit.
lnanek2 12y ago
Honestly, I find their mobile offering really disappointing. Several times I've wanted to do things with it and not been able to, like login using only the mobile app and download some pictures I backed up for my wife, etc.. They don't seem to see the mobile app as a real, full app. This connect to desktop thing just makes it even worse. I didn't have my laptop around at the time. We've had other big issues with it involving the iPad version not being able to do things.

81 points by tweakz 12y ago

deleted 12y ago

[deleted]

vdaniuk 12y ago
I've been monitoring HN reactions to Dropbox news with interest and I can conclude that mentioning Rice in comments has fallen out of vogue and is punished with downvotes of power users. HN was outraged at first, now it's meh about the whole deal. A regrettable development that shows companies that one can easily alienate a part of its early adopters, but bad rep won't stick if you continue to ship shiny things.
- bronson 12y ago
  Gotta wonder about Dropbox and HN both being YC projects... Think that helps Rice be a non-issue?
  - dang 12y ago
    Certainly not in any way that I'm aware of.
    - okpl 12y ago
      "...while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec." quite an intriguing attack surface for mobile malware...arbitrary code of Dropbox's choosing when combined with an 0day or two?
    - deciplex 12y ago
      Unfortunately, we have to take your word for it, because there is no transparency of which of the various uncountable "bans" are associated with your account, to say nothing of why they are put there in the first place. You're probably not punishing posters for reminding people that Dropbox is an enthusiastic supporter of illegal domestic NSA spying operations, but there is no way to know that, either. Trust, but verify^H^H^H^H^H^H^H^H^H^H in other words.
    - vdaniuk 12y ago
      Really? Care to tell us why the okpl user is already hell banned after posting 2 comments in this thread criticizing Dropbox and Rice involment?
      - dang 12y ago
        Oh my hot-headed, un-Bayesian friends: do you really think we'd be so dumb as to ban people for criticizing Dropbox and Rice after just saying we don't do that? That would be the I Do Not Freebase Cocaine of website moderation [1]. Comments posted from Tor IP addresses by new accounts are killed automatically [2] because of past abuses by trolls. Moderators unkill these when we see them and mark the accounts legit when they're not obviously trolling. I just did that here, even though "Sounds like Condi didn't need much time" is pretty far from a quality comment. Before you seamlessly segue into outrage at that instead, may I mention that we've got a sweet idea for dumping that practice and a truckload of others in a grand devolution of moderation powers to the community. Maybe one day we'll even get to implement it, instead of typing the same comments over and over. Lord and NSA knows it'd be one ginormous headache off our hands. 1. https://www.youtube.com/watch?v=2-ckIv1tiaU https://www.youtube.com/watch?v=2-ckIv1tiaU 2. https://hn.algolia.com/?q=noob+tor#!/comment/sort_by_date/prefix/0/comments%20from%20new%20accounts%20tor https://hn.algolia.com/?q=noob+tor#!/comment/sort_by_date/pr...
        vdaniuk 12y ago
        Nope, I didn't think that you are dumb at all. However, I believe that you have a clear cut conflict of interest that you may not be able to mitigate no matter how hard you try. http://www.ted.com/talks/dan_ariely_beware_conflicts_of_interest http://www.ted.com/talks/dan_ariely_beware_conflicts_of_inte... Also it would be really cool to add [tor noob] fair describing a hellban reason.

ChikkaChiChi 12y ago

Fascinating stuff, but was this a problem in need of a solution? Was Dropbox seeing that many issues with people running the install on their local machine? Were they able to differentiate between those who felt the install was a hassle versus those who simply opted to not install it?

ksb 12y ago
There are a lot of places that we were seeing users drop off the radar when trying to install. Through a combination of logging analytics and user studies we figured out what the main problems were and designed this flow to solve them. (See my post from last week for more context on why we built this: https://news.ycombinator.com/item?id=8168792 https://news.ycombinator.com/item?id=8168792)
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- shawn-butler 12y ago
  >> Instead, we created a custom version of the signing tools which complied with the Authenticode spec (for Windows) while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec. >> Can you offer some more info on this topic in a follow-up post?
  - huy2n 12y ago
    Inside the Authenticode signature, there is an area for unauthenticated attributes (e.g., if you timestamped your executable, the timestamp (PKCS#9) is stored as an unauthenticated attribute, http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode.aspx) http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-u...). These attributes are not verified by Windows Authenticode when the executable is run. So if you can add a new unauthenticated attribute into the signature, you can make any change we want to that attribute without invalidate the signature. In order to inject an unauthenticated attribute to the signature, you may want to use osslsigncode for signing (instead of MS signtool).

bzelip 12y ago

The UX of this blog post on mobile (HTC One M8, kit Kat) forces a horizontal scroll to read all of the page's content.

brianzelip 12y ago
update: the non-responsive display was due to rendering of the page in the HN mobile app (by Creative Pragmatics) that I use. Visiting the page in a proper browser proved a better experience.

plorg 12y ago

I typically set my browser to clear cookies every session. Is there any provision for such a scenario? The authentication flow seems to suggest that if the browser was closed and cookies cleared, the user would not be allowed to install Dropbox.

jhurwitz 12y ago
> If any of our conditions isn’t met, we abort auto sign-in and ask the user to log in with an email and password. In this case, the install succeeds and only auto sign-in fails.
psychotik 12y ago
The ultimate fallback always is to revert to letting user sign in manually. Installation success doesn't depend on cookies, so that should be just fine.

jgalt212 12y ago

What's the use case for drop box on mobile devices (other than tablets)?

jerhinesmith 12y ago
I use it as online backup for my photos -- the dropbox app syncs them when I'm on wifi.
darkmirage 12y ago
Photos and quick viewing of shared documents are common use cases.
etimberg 12y ago
I use it with You Need a Budget to sync between my phone and my computers.

mwcampbell 12y ago

I wonder if there are any plans to rewrite the desktop client in C++ (with some Objective-C++ on Mac), presumably using the libdropbox C++ libraries that Dropbox has been developing for the mobile apps, to get the installer size down and leverage more common code across platforms.

psychotik 12y ago
Not currently, unfortunately. The complexity of how the Dropbox client works is enough to not pollute libdropbox with at this time. The idea here is correct though - were we to rebuild it at this time, we would look at potentially abstracting a lot things into a libdropbox-like library
- mike_hearn 12y ago
  I'm surprised you haven't tried harder to optimise the download size ... the blog post says it ships a nearly full Python runtime, but surely you don't actually use it all? The core interpreter is I'd think quite small and Python code should compress very well.

timbre 12y ago

I'm surprised you can sign an executable, then modify it while preserving the validity of the signature, as I always though this is exactly what code signing is meant to prevent. Can anyone who knows more about this than me (a low bar!) explain whether this is a flaw in the signing mechanism or is actually okay?

NortySpock 12y ago
From the article: "Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec. We make the tag buffer an unverified section so that the tag buffer can change without having to re-sign the binary." So they sign 90% of the executable, but 10% of it is unsigned.
chrissnell 12y ago
More importantly, what good is a code-signed executable when that executable can simply download a payload from the internet like this Dropbox installer does? Code signing seems like a feel-good mechanism for users. Yeah, we guarantee that the executable that you downloaded was signed by a legitimate entity but once you run it, good luck. This type of "meta installer" seems ripe for exploitation. Unscrupulous entities create a legit signed app that later downloads a malicious payload; legitimate distributors might also find themselves to be the target of attackers who want to alter that downloadable payload.
- timbre 12y ago
  I think the point of code signing is to ensure that the program was really written by Dropbox, so _if_ you trust Dropbox you should trust the program. That trust should definitely include both Dropbox's good intentions and their competency to prevent their payload system from being subverted.
  - deciplex 12y ago
    >That trust should definitely include both Dropbox's good intentions and their competency to prevent their payload system from being subverted. Only a fool would, after their actions of the past year, still believe this company has good intentions or that their payload system hasn't already been totally compromised (with their cooperation, no less).

okpl 12y ago

"...while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec." sounds like Condi didn't need much time for Dropbox to build a nice new home for NSA implants. quite an intriguing attack surface for mobile malware...arbitrary code of Dropbox's choosing when combined with another 0day or two? no thanks. this makes me glad i dropped dropbox like a bad habit.

lnanek2 12y ago

Honestly, I find their mobile offering really disappointing. Several times I've wanted to do things with it and not been able to, like login using only the mobile app and download some pictures I backed up for my wife, etc.. They don't seem to see the mobile app as a real, full app. This connect to desktop thing just makes it even worse. I didn't have my laptop around at the time. We've had other big issues with it involving the iPad version not being able to do things.