Hi all.
I am slightly pissed off and disappointed. Why? For some of You that may not know:
Dropbox is changing / changed their policy and usage terms. To comply with U.S. law they are now obliged to provide unencrypted access to Your private dropbox account content to any of the 3 letter agencies if they provide court order.
This is not my biggest concern. I don’t touch anything that’s illegal so I don’t store anything illegal in my dropbox. What I have realized is far more worse then that. If they can show decrypted content of the folder to the FBI or other authorities it means that they could take a sneak peak at Your files whenever they felt like it in the past even tho they were stating that all they can see is a sudo-random blob of encrypted data which they will not be able to decrypt and have a look at. This – due to my motto “Trust No1” is unacceptable. One bad apple in their crew basket… and all my files are viewable to him. I don’t keep any financial records / passwords / ~ folder content / other valuable data in the dropbox… but that’s because I would never place them somewhere where they can be accessed by a 3rd party…
Second thing is that if someone gains access to Your hard drive and copies 1 little file… gains access to Your dropbox account. No password needed. If You change password attacker still can connect.
I am thinking about getting rid of my dropbox accounts. Seriously… Security fail. Privacy fail. Trust fail.
I have removed all my dropbox accounts… and cleaned up my hdd from any leftovers.
There… I am dropbox free.
Thanks for reading.
LEO: Now, I wanted to ask you about this next topic because I use, as you know, I use Dropbox. And Miguel de Icaza, who is a great developer and a really important guy in the open source community, said, “What the hell?” Because apparently Dropbox has been assuring everybody that they use strong encryption that they can’t decrypt.
STEVE: Well, yeah. And there’s two things. There’s two issues. One is that Dropbox recently updated their terms of service to say explicitly what was always apparently implicit. Quoting from their new terms of service, they say: “As set forth in our privacy policy, and in compliance with United States law, Dropbox cooperates with United States law enforcement when it receives valid legal process, which may require Dropbox to provide the contents of your private Dropbox. In these cases, Dropbox will remove Dropbox’s encryption from the files before providing them to law enforcement.”
Now, this sums up more perfectly than I ever could why I chose Jungle Disk for my own remote cloud-based backup. And that is, I did a full security analysis of Jungle Disk and verified that all that is ever being put up to Amazon’s S3 cloud stuff is pre-encrypted data. That is, my Jungle Disk client has the key and everything it sends. So all Amazon gets is opaque pseudorandom noise that they have no ability to decrypt. I mean, it’s full TNO, Trust No One, as my acronym for this, which is the only way I would ever store something in the cloud. So here Dropbox has formally acknowledged that they have the ability to decrypt the contents of all of their users’ data, and that they will do so when ordered to by a court order from the United States.
LEO: So as Miguel points out, well, if they can do it by court order, then they’ve had that capability all along. So they essentially misrepresented the encryption capabilities.
STEVE: Well, and see..
LEO: And he says this is a larger issue, not so much government, but that means employees could do it. And even with a company that has very strong data policies like Google we see these things happen.
STEVE: Very, very good point. It means that keys could get compromised; keys could get lost. Or, as you say, you could have a bad apple employee who realizes, hey, we’re hosting a celebrity. I wonder what he’s storing in his Dropbox?
LEO: So I make sure I don’t put anything of a private nature in my Dropbox. But I’m going to make sure I don’t. And you’re right. I think if you’re going to do it, if you want to store something like financial records, use Jungle Disk.
STEVE: Well, and here’s another – well, or, and this works, too…
LEO: Pre-encrypt.
STEVE: Exactly. Only store stuff that you have encrypted up there, where you’re pre-encrypting that data. And this is why, when I see someone saying “industry standard AES 256-bit encryption,” it’s like, that means nothing. I mean, unfortunately it catches out people who don’t listen to this podcast, who assume that, if you’re using state-of-the-art encryption, then you must be safe. No. I mean, I would imagine that means that the link is encrypted. And it does sound like they’re storing it in an encrypted fashion. But they’re storing it with a key that they have. So that doesn’t really help.
LEO: Yeah. That’s the question, who has the key?
STEVE: Right. And the best solution is for no one but you to have the key. And the only way to do that is to pre-encrypt and only store encrypted stuff in the cloud. Now, the other issue that came up was a question of their authentication. Someone named Derek Newton, who is a security researcher, was poking around in Dropbox-like applications, and he just decided he would take a look and see what they left behind, what was left behind after they installed. What he found was that, specifically in the case of Dropbox, there is a single file called config.db, which is an SQLite database file, which contains the email address, the dropbox_path, that is, where the Dropbox folder is on your system, which is being synchronized to the Dropbox in the cloud, and the host_id. Any SQLite DB-compatible client is able to open this file and look at it.
And what he determined by experimentation is that the only thing that identifies you to Dropbox is the host_id. There is no other lockage of that file to a given system. And so what he posted – and again, I learned about this from people saying in Twitter, hey, Steve, what do you think about this? And this has been a constant flow for the last couple weeks. And I mentioned last week that I hadn’t had a chance to dig into this, but I would, to look into it and verify it. So I did want to follow up for everyone who’s been wondering.
So what this means is that, if you weren’t protecting this file, or if anything got onto your system which was able to grab this file through social engineering attack or spyware or malware, whatever, if you lost control of that file such that it was in any way exfiltrated from your control, then that file can be installed on any other system. And that provides the sole authentication of you, the instance of you, to Dropbox such that, with no other information, no username, password, no logon, anything, that authenticates that new system. And there is – it doesn’t appear as a new machine in the set of machines that you have authorized to use. It’s merely a clone of that first one, which then has full access, unencrypted access, to your Dropbox contents. Which to me says these guys aren’t really looking at security.
I mean, on one hand we know now that they can decrypt the contents of our Dropboxes. And this could clearly have been done in a way that was more secure. Even if you change, if the user changes his username and password, that doesn’t invalidate the host_id. It still functions. And so if somebody had it, their connectivity survives across a user changing his username and password. So it’s just they really could have easily done a much better job of hashing username and password into this, tying it in some fashion, for example, to the serial numbers of the hard drives on the system. I mean, just anything to make it more difficult than simply one file which you can put on any machine anywhere, and suddenly it’s authenticated just as solidly as the system it came from.
LEO: Yeah, that’s not good.
STEVE: So not good news over on the Dropbox side.
LEO: You know, there are alternatives. LaCie has a similar service to Dropbox that’s Java based. I don’t know if it’s more secure. But I think maybe it’s time to look and see what the other alter- I love Dropbox. And I hope they respond to this by making it more secure. That would make everybody happy.
STEVE: I think they can. I mean, one would imagine they will because it’s so trivial. I mean, all they have to do is listen to this podcast for a while.
LEO: Right, and add some encryption features. The other one to look at, I’ll take a look at, is from LaCie, it’s called Wuala. Randal Schwartz told me about it. It’s Wuala.com. Very similar to Dropbox. I’ll look and see if they say, when they say all files get encrypted – see, that’s the thing, is “get encrypted.” Well, what does that mean? Where, is the question.
STEVE: Yeah, exactly. And that’s just it. Unless there is a full security analysis available of how it works and what it does, you just can’t trust it.
LEO: Here’s what Wuala says. It says all files are directly encrypted on your desktop. Your password never leaves your computer. Not even we as a provider can access your files or your password.
STEVE: Well, that’s all good sounding.
LEO: That’s what you want – validated, of course.
STEVE: Yeah.
LEO: I’m going to take a look at them. Randal Schwartz recommended them. He likes them a lot, so I’m going to take a look at them as an alternative to Dropbox.
