Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?

share|improve this question

closed as unclear what you're asking by SilverlightFox, Xander, Noordung, Rory Alsop Aug 27 at 13:53

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

6  
In my opinion, this is not a great question for IT Security. You could have learned the answer by simply using Google. If you can't take the time to do a simple Google search before posting your question, you are being disrespectful to others on this site: I think we ought to be able to expect at a minimum that you will spend 5 minutes with Google before expecting others to volunteer their time to help you. –  D.W. Jul 18 '11 at 2:04

3 Answers 3

up vote 9 down vote accepted

There was been at least five issues reported over the past few months

  1. Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data
  2. Data stored in dropbox is accessible by dropbox employees
  3. A recent code update meant that any dropbox account could be accessed with just the users email address for a short period of time.
  4. The Terms of service were recently updated to give Dropbox much wider privileges to your data
  5. You can detect if another user has uploaded a file to dropbox by monitoring the amount of time it takes to upload the file
share|improve this answer

I know of two in the last little while. Wired did a reasonably good job explaining both: http://www.wired.com/threatlevel/2011/06/dropbox/ and http://www.wired.com/threatlevel/2011/05/dropbox-ftc/.

share|improve this answer
2  
Down-voted for no actual content in answer. –  Iszi Jul 17 '11 at 5:11
1  
@Iszi Really? Come on... It was a googleable answer that they could have found themself. –  Steve Jul 17 '11 at 16:46
2  
@SteveS - exactly, we shouldnt encourage googlebait. I didnt downvote you, but I strongly considered closing the question... As I discussed in Information Security Chat. –  AviD Jul 17 '11 at 21:51

Basically what it gets at is the same thing as always, you need to encrypt data before giving it to a third party. The other security problem is you can masquerade as the properly authenticated user for an account. Schneier dropbox article

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.