Democratic Underground Latest Greatest Lobby Journals Search Options Help Login
Google

Dropbox Lied to Users About Data Security, Complaint to FTC Alleges

Printer-friendly format Printer-friendly format
Printer-friendly format Email this thread to a friend
Printer-friendly format Bookmark this thread
This topic is archived.
Home » Discuss » General Discussion Donate to DU
 
Newsjock Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 05:05 PM
Original message
Dropbox Lied to Users About Data Security, Complaint to FTC Alleges
Source: Wired

Dropbox, the wildly popular online storage system, deceived users about the security and encryption of its services, putting it at a competitive advantage, according to an FTC complaint filed Thursday by a prominent security researcher.

The FTC complaint charges Dropbox (.pdf) with telling users that their files were totally encrypted and even Dropbox employees could not see the contents of the file. Ph.D. student Christopher Soghoian published data last month showing that Dropbox could indeed see the contents of files, putting users at risk of government searches, rogue Dropbox employees, and even companies trying to bring mass copyright-infringement suits.

Soghoian, who spent a year working at the FTC, charges that Dropbox has and continues to make deceptive statements to consumers regarding the extent to which it protects and encrypts therir data, which amounts to a deceptive trade practice that can be investigated by the FTC.

... Those architecture choices mean that Dropbox employees can see the contents of a users storage, and can turn over the non-encrypted files to the government or outside organizations when presented with a subpoena.

Read more: http://www.wired.com/threatlevel/2011/05/dropbox-ftc/
Printer Friendly | Permalink |  | Top
aquart Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 05:46 PM
Response to Original message
1. Online storage. And people believed them?
Good Lord.
Printer Friendly | Permalink |  | Top
 
mike_c Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:02 PM
Response to Original message
2. there's an easy solution....
Edited on Fri May-13-11 06:03 PM by mike_c
Encrypt your own files before storing them in your dropbox. That's a no-brainer for anyone interested in data security. At the very least, if we rely on someone else's assurances of encryption we should ask for-- and understand-- the details about data security they provide. But better not to trust strangers at all, frankly. Encrypt your own files.
Printer Friendly | Permalink |  | Top
 
kestrel91316 Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:16 PM
Response to Reply #2
3. Hi mike c! Can you give me a quick plain english tutorial on how to encrypt,
say, a Word document? I am just not that computer-savvy and don't want to lock something up where I can't retrieve it, lol.
Printer Friendly | Permalink |  | Top
 
mike_c Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:37 PM
Response to Reply #3
6. hi kestrel....
Encryption isn't difficult-- there are lots of free, open-source, and for-profit encryption programs available that mostly do it transparently and automatically. TrueCrypt is one: http://www.truecrypt.org/, SafeHouse is another: http://www.safehousesoftware.com /. There are lots more. Most have pretty straightforward instructions.

In the present thread, one could set up a TrueCrypt encrypted volume in the DropBox folder and every time you added files to that directory they would be automatically encrypted on the fly and decrypted just as transparently when accessed later.
Printer Friendly | Permalink |  | Top
 
Occulus Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 10:31 PM
Response to Reply #3
9. I'm going to add to Mike_c's advice and talk about the passwords themselves
Edited on Fri May-13-11 10:34 PM by Occulus
You really, really don't want an easy-to-guess password. Initials, birthdates, pets' names, and such should be right out. Ideally, your password is complete garbage, like this:

tYy&M,@Q

or something similar. I can tell you, from experience, that truly secure passwords are an unholy bitch to memorize, but once you do and you use it enough for your brain to have muscle memory of it, the password will be actually easier to 'just type in' than it will be to write it out if you have to think about it. It's hard to describe that, but one day, something in your head will just 'click' and you'll be able to type in the password as quickly as you type actual words.

DON'T use something like:

kestrel051963

where 061963 is your date of birth. Definitely do NOT use names or places, and don't use dictionary words either. Such words are very easily hacked.

DO mix capitals and lower case letters, DO use punctuation- in particular, punctuation other than the comma and the period, and DO use special characters, such as !, @, #, $, %, ^, & or * where allowed (the software mike_c describes, in general, allows you to do just that).

Hope this helps!
Printer Friendly | Permalink |  | Top
 
Incitatus Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:19 PM
Response to Original message
4. Why do people use a service like this?
Storage devices are very cheap. Why would anyone upload something they want to keep private to an online site?
Printer Friendly | Permalink |  | Top
 
TheWraith Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:35 PM
Response to Reply #4
5. I use it. It's an easy way to store things so they're accessible to me elsewhere.
I don't necessarily want to carry all my storage with me at all times, or maintain a running tally of which files are where.

It also lets me fairly quickly transfer files to or from other devices which I can't plug a USB drive into.
Printer Friendly | Permalink |  | Top
 
mike_c Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 06:45 PM
Response to Reply #4
7. I use DropBox daily....
Edited on Fri May-13-11 06:48 PM by mike_c
I might work on any one of half a dozen of my own computers at any given time-- in my home office, my University office, my lab, on my laptop at the library, or on a smart classroom computer. I used to use a portable hard drive to synchronize files on my main three or four computers, but you have to be pretty diligent to avoid confusing file versions or to prevent data loss when you get behind. It works, but after you try DropBox you'll never want to use such a cumbersome method for synching files again. Drop them in your DropBox folder and they simply appear on every computer you have running DropBox, and they're available via browser from any other computer. It's super convenient. It just works. Now I don't maintain four or five (often imperfectly) mirrored file systems manually-- I just store anything that I want synched in my DropBox folder. You can store your entire user file system there if you want, making all your files instantly accessible from anywhere. Set up a TrueCrypt volume inside your DropBox and viola! Privacy.
Printer Friendly | Permalink |  | Top
 
kestrel91316 Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 10:14 PM
Response to Reply #4
8. I have computers at home AND at my office, and I frequently need certain
files in both locations. I was going crazy with flash drives and backup hard drives and such until I found Dropbox.

I do some writing. I can work on a project at work, and then access the same files at home to keep working in the evening.

And my extensive family photo collection is stored on BOTH hard drives AND in the cloud.

Any time I turn on either computer it automatically syncs with the more recent file editions. I LOVE IT!!!!! Really, my stress level has plummeted because of this software.
Printer Friendly | Permalink |  | Top
 
Occulus Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 10:36 PM
Response to Reply #4
10. Well, people who travel a great deal would find it convenient
Business or pleasure, traveling with a computer means your hard drive may be subject to search. A service like Dropbox is much, much more convenient than TSA taking an image of the whole thing, or mailing the drive to yourself, or lugging around a portable hard drive.

I would do what mike_c suggests, though, and encrypt it with an open-source solution lacking any backdoors first (using the sorts of passwords I describe above), just to be on the safe side.
Printer Friendly | Permalink |  | Top
 
Renew Deal Donating Member (1000+ posts) Send PM | Profile | Ignore Fri May-13-11 10:41 PM
Response to Reply #4
11. It's not always about keeping stuff private
Sometimes easily sharing a file is more important. It's a great way to share files between people or to have the file in more than one place. No disks or copying needed.
Printer Friendly | Permalink |  | Top
 
DU AdBot (1000+ posts) Click to send private message to this author Click to view 
this author's profile Click to add 
this author to your buddy list Click to add 
this author to your Ignore list Tue Jul 22nd 2014, 06:12 PM
Response to Original message
Advertisements [?]
 Top

Home » Discuss » General Discussion Donate to DU

Powered by DCForum+ Version 1.1 Copyright 1997-2002 DCScripts.com
Software has been extensively modified by the DU administrators


Important Notices: By participating on this discussion board, visitors agree to abide by the rules outlined on our Rules page. Messages posted on the Democratic Underground Discussion Forums are the opinions of the individuals who post them, and do not necessarily represent the opinions of Democratic Underground, LLC.

Home  |  Discussion Forums  |  Journals |  Store  |  Donate

About DU  |  Contact Us  |  Privacy Policy

Got a message for Democratic Underground? Click here to send us a message.

© 2001 - 2011 Democratic Underground, LLC