Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?
There was been at least five issues reported over the past few months
- Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data
- Data stored in dropbox is accessible by dropbox employees
- A recent code update meant that any dropbox account could be accessed with just the users email address for a short period of time.
- The Terms of service were recently updated to give Dropbox much wider privileges to your data
- You can detect if another user has uploaded a file to dropbox by monitoring the amount of time it takes to upload the file
I know of two in the last little while. Wired did a reasonably good job explaining both: http://www.wired.com/threatlevel/2011/06/dropbox/ and http://www.wired.com/threatlevel/2011/05/dropbox-ftc/.
Basically what it gets at is the same thing as always, you need to encrypt data before giving it to a third party. The other security problem is you can masquerade as the properly authenticated user for an account. Schneier dropbox article