43

For the record, I understand that absolutely no service is safe, and "the only way to keep a computer from getting hacked is to never connect it to the network". So, we've got that out of the way.

I wanted to understand the Dropbox has started encrypting its data-at-rest with 256-bit AES encryption. So, my simple question is, do we still need to encrypt our Dropbox contents with TrueCrypt?

Are there any real advantages in terms of security/encryption in using Dropbox?

Improve this question
17
  • 8
    Welcome to Information Security SE. Is this question about Box or Dropbox? I assumed the latter and edited, feel free to rollback. Can you source the "2048-bit AES"?
    – Jedi
    Dec 1, 2016 at 4:39
  • 41
    For the record, 2048-bit AES doesn't exist. AES is a common symmetric encryption standard with three variants that all use a block size of 128-bits with a key that is either 128, 192, or 256 bits (that is the key is a random number is 128, 192, or 256 bits long). However, RSA, a common asymmetric encryption standard commonly uses 2048 bit keys where the the part of the key that's length is given by 2048 bit isn't a random number but is the product of two 1024-bit numbers.
    – dr jimbob
    Dec 1, 2016 at 5:28
  • 39
    Who's your adversary here? If a government/police subpoena your data, Dropbox will unencrypt it for them, but if you encrypted it with your own keys beforehand then they're out of luck.
    – Robert Fraser
    Dec 1, 2016 at 7:48
  • 7
    Huh? Am I missing something here? Truecrypts encrypts the HD, as soon as data is lifted from it it is undecrypted. You cannot encrypt our Dropbox contents with TrueCrypt. Unless you mean to say a local copy/mirror of your Dropbox contents? Then edit your question.
    – user13695
    Dec 1, 2016 at 12:22
  • 17
    @JanDoggen, you can use TrueCrypt to create local, encrypted virtual drives/containers.
    – Holloway
    Dec 1, 2016 at 13:19

3 Answers 3

Reset to default
85

It does not matter much how the data are encrypted as long as the owner of the data is not the only one in control of the encryption key. This in effect means that data encryption and decryption should only be done at the client and only in a safe environment where only trusted software is running. This is not the case with Dropbox: Dropbox has access to the plain data both from the Dropbox client running on your system and on the server side before encrypting for rest. Also Dropbox can decrypt the data whenever they want because they have access to the encryption key. And they will do it for sure and without you noticing when law enforcement requires it.

Whether you consider this safe enough for your own use is your own decision.

Improve this answer
4
  • 4
    This is why they can perform data deduplication.
    – mythofechelon
    Dec 1, 2016 at 19:28
  • 1
    @mythofechelon reversable (by them) encryption is also the maximum that can be supported for features that let you use dropbox as an easy way to share files with people. Having to download and decrypt offline will make it significantly harder to use for less technically inclined people.
    – Dan Is Fiddling By Firelight
    Dec 2, 2016 at 0:26
  • "in control of the encryption key" ... or decryption key of course, in case of RSA based hybrid encryption.
    – Maarten Bodewes - on strike
    Dec 2, 2016 at 16:23
  • Well, doing extra encryption (outside the client's control) certainly can't hurt. But I agree that we shouldn't rely on it. There's also the possibility that Dropbox's keys fall into hands we didn't plan for (in my mind, the police aren't the most likely to access the data, even if you were hiding something illegal: there are plenty of hackers who'd want to do that.)
    – jpaugh
    Dec 3, 2016 at 17:14
3

As was stated in the comments, if you have encrypted the data yourself, with your own keys, and then it is copied to DropBox without those keys being available to them, they would not be able to decrypt the data. If you rely solely on their own algorithms/software/keys, they would have access to them, and could therefore decrypt the data if it were subpoenaed by law enforcement.

Improve this answer
6
  • 4
    could therefore decrypt the data if it were subpoenaed by law enforcement - A bad actor on the inside could do the same.
    – Carey Gregory is on strike
    Dec 3, 2016 at 0:10
  • @CareyGregory Very true.
    – vapcguy
    Dec 3, 2016 at 0:29
  • And then (as always) there's the details. OK, so you encrypt the data at rest, and this is the usual thing people say for marketing purposes. But how do you safeguard the key(s) you used to encrypt it? The answer to that decides whether the encryption-at-rest ensures data security in the event of someone physically stealing their storage array, vs. ensuring absolutely nothing beyond buzzword-compliance.
    – Steve Jessop
    Dec 3, 2016 at 16:33
  • It's been my experience that the keys for sensitive data are generated on removable hard drives that are then locked in a safe. If they are ever brought out & re-connected to the computer for any reason, that computer is not connected to a network during the process. If a bad actor has access to the safe, then either your trust/vetting mechanisms for your employees have broken down, or you don't have the physical security safeguards in place to be doing this kind of sensitive stuff in the first place. But short of having a fortress, roving security guards, etc., you can't keep everyone out.
    – vapcguy
    Dec 5, 2016 at 15:09
  • The best you can do is to have the 2 mediums (keys, encrypted data) in different locations & hope the thieves don't know where both are & keep that information to the fewest possible people on a need-to-know basis. Then have an army of well-trained security guards at both locations w/biometric security to enter the room, invisible laser intrusion system (and hope your thief isn't a gymnast), etc. But I don't believe any such system is foolproof. Best you can hope for is to have cameras feeding multiple places (so thieves can't steal all your video) and hope they aren't wearing masks.
    – vapcguy
    Dec 5, 2016 at 15:14
2

Dropbox does not offer zero knowledge encryption, and is able to decrypt and turn your data over to law enforcement if they are asked to do so. As someone who has used Dropbox for many years I always did so with an understanding that they would do so, and stored only appropriate data there.

For an individual or organization that wants to store data in the cloud but also wants or needs for it to be as close to completely secure as possible, the encryption tool that I prefer to use is Cryptomator, because it encrypts your data before ever sending it to Dropbox. Your files can be accessed on your local machine, but all Dropbox ever sees is the files after they have been encrypted.

I use this method to securely sync encrypted password databases across several different machines and am confident that even if my Dropbox account is compromised, my password databases will be secure. I wrote instructions for how to set up Cryptomator and published them here: https://www.alaskacomputerguy.com/category/howto/how-to-encrypt-dropbox-folder

Improve this answer
1
  • +1 for Cryptomator. It's open source, uses strong encryption (well, except for file timestamps and sizes, if that's a concern to you), multi-platform, and has a friendly UI.
    – Simon East
    Nov 23, 2021 at 3:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .