Reply to topic  [ 5 posts ] 
Dropbox authentication: insecure by design 
Author Message
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:36 pm
Posts: 5161
Location: /dev/tty0
Reply with quote
Quote:
For the past several days I have been focused on understanding the inner workings of several of the popular file synchronization tools with the purpose of finding useful forensics-related artifacts that may be left on a system as a result of using these tools. Given the prevalence of Dropbox, I decided that it would be one of the first synchronization tools that I would analyze, and while working to better understand it I came across some interesting security related findings.


Continue reading

I know a few users here use it...It might be worth not relying on it quite so much for sensitive stuff...


Wed Apr 20, 2011 9:43 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:56 pm
Posts: 12030
Reply with quote
I've only ever used it for photos when burning a DVD would be wasteful, and involve me getting off my ass to hand it over.
It never occurred to me to use it for anything that had a potential security aspect to it.

_________________
www.alexsmall.co.uk

Charlie Brooker wrote:
Windows works for me. But I'd never recommend it to anybody else, ever.


Wed Apr 20, 2011 9:46 pm
Profile
What's a life?
User avatar

Joined: Thu Apr 23, 2009 8:25 pm
Posts: 10691
Location: Bramsche
Reply with quote
The information stored on the server is also encrypted using a key that Dropbox know, so they can decrypt the data and pass it on at will.

Any cloud service which does the encryption on the server, or sends the key to the server is insecure.

Wuala sounds better (from Lacie), they encrypt the data on the client, before sending it into the cloud. The same goes for Carbonite - although that is more a backup solution than a remote synchronsation system.

Jungledisk is also worth a look, if security is an issue. If you insist on using drop box, make sure you encrypt all data locally, before allowing it to sync with Dropbox.

_________________
"Do you know what this is? Hmm? No, I can see you do not. You have that vacant look in your eyes, which says hold my head to your ear, you will hear the sea!" - Londo Molari

Executive Producer No Agenda Show 246


Fri Apr 22, 2011 11:51 am
Profile ICQ
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
big_D wrote:
if security is an issue. If you insist on using drop box, make sure you encrypt all data locally, before allowing it to sync with Dropbox.

I suppose there's some pretty personal stuff on my dropbox, but if someone wants to get their kicks from looking at my holiday snaps or CV I'm really not that bothered :lol:

I don't have any security sensitive stuff on there. Considering I have dropbox on my phone and my PC at work, it would be quite silly. If I did, I'd probably RAR it up with a reasonably strong password. I think RAR is only crackable by brute-force?

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Fri Apr 22, 2011 1:07 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 6:27 pm
Posts: 12251
Reply with quote
I may have to have words with a client, just to put them in the picture.

_________________
All the best,
Paul
brataccas wrote:
your posts are just combo chains of funny win

I’m on Twitter, tweeting away... My Photos Random Avatar Explanation


Fri Apr 22, 2011 7:02 pm
Profile
Display posts from previous:  Sort by  
Reply to topic   [ 5 posts ] 

Who is online

Users browsing this forum: No registered users and 19 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group
Designed by ST Software.