Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?

share|improve this question
3  
In my opinion, this is not a great question for IT Security. You could have learned the answer by simply using Google. If you can't take the time to do a simple Google search before posting your question, you are being disrespectful to others on this site: I think we ought to be able to expect at a minimum that you will spend 5 minutes with Google before expecting others to volunteer their time to help you. – D.W. Jul 18 '11 at 2:04

3 Answers

up vote 9 down vote accepted

There was been at least five issues reported over the past few months

  1. Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data
  2. Data stored in dropbox is accessible by dropbox employees
  3. A recent code update meant that any dropbox account could be accessed with just the users email address for a short period of time.
  4. The Terms of service were recently updated to give Dropbox much wider privileges to your data
  5. You can detect if another user has uploaded a file to dropbox by monitoring the amount of time it takes to upload the file
share|improve this answer
up vote 3 down vote

I know of two in the last little while. Wired did a reasonably good job explaining both: http://www.wired.com/threatlevel/2011/06/dropbox/ and http://www.wired.com/threatlevel/2011/05/dropbox-ftc/.

share|improve this answer
1  
Down-voted for no actual content in answer. – Iszi Jul 17 '11 at 5:11
1  
@Iszi Really? Come on... It was a googleable answer that they could have found themself. – SteveS Jul 17 '11 at 16:46
2  
@SteveS - exactly, we shouldnt encourage googlebait. I didnt downvote you, but I strongly considered closing the question... As I discussed in IT Security Chat. – AviD♦ Jul 17 '11 at 21:51
up vote 2 down vote

Basically what it gets at is the same thing as always, you need to encrypt data before giving it to a third party. The other security problem is you can masquerade as the properly authenticated user for an account. Schneier dropbox article

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.