A warning to Dropbox users.

[RemoteTechs]

Our favorite sync tool (Yes sync tool - NOT back up tool) Dropbox have been having somewhat of a disaster with security issues lately.

To begin with they admitted recently that their security isn't quite as secure as they lead us all to believe, they had been telling users that their files were totally encrypted and even Dropbox employees could not see the contents of the files.

"All files stored on Dropbox servers are encrypted (AES256) and are inaccessible without your account password."

Which they have now been forced to change to:

"All files stored on Dropbox servers are encrypted (AES 256)."

Also architecture choices mean that Dropbox employees can see the contents of a user’s storage, and can turn over the nonencrypted files to the government or outside organizations when presented with a subpoena.

"Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account"

Bad wording or deliberate misguiding you decide?!

However their latest security failure is more clear cut and for me as a user a lot less excusable!

Apparently, Dropbox published a code update which inadvertently removed the need to authenticate. So you could log in to other people's accounts without knowing their passwords at all. They have a addresses the issue on their blog, although I doubt most of their users ever saw it!

Fortunately I have never trusted them to "backup" my data since their product isn't really a true back up service and is aimed at syncing files across machines, however, I have some files and folders up their that I have promptly moved.
I have seen many posts where people entrust their data to Dropbox as a back up solution!

 

[Posilan]

I have seen many posts where people entrust their data to Dropbox as a back up solution!

I've insisted time and time again that Dropbox is never suitable as a backup solution and would never advovate the storing of anything you would not want a third party to see.

I posted about the T&C changes a while back, but at security flaw like that is just inexcusable. For them to actually be aware of the problem and make a code update is bad too - they should have shut the service down the instant they suspected a security issue - not work behind the scenes on the problem whilst still leaving files vulnerable.

Steve

 

[RemoteTechs]

Like wise Posilan,
I think there are two reasons people use it for back up, up to 2 gig its free
And clearly false marketing from Dropbox makes the system seem a lot safer than it is.

 

[Posilan]

I think there are two reasons people use it for back up, up to 2 gig its free

A 2GB flash drive for less than £5, attatched to your keyring is probably more secure

 

[RadiusBPO]

I use Dropbox pretty heavily, its a nice way to store files which i need to access from multiple computers at multiple locations and share folders with people all over the world.

There is nothing valuable there though, just spreadsheets, ranking reports, etc etc.

 

[Deleted member 114251]

I like DropBox for simple sync of files between computers. There are other products out there that provide a more secure solution for people needing it.

It's all personal taste I guess.

 

[Curious]

I've always used Dropbox as my backup, not for anything important but perhaps I should reconsider. Any of you useful chaps able to recommend a decent secure backup service?

 

[RadiusBPO]

Just been reading this on encrypting files in dropbox so even if someone gains access it is unlikely they can read the files

http://uk.lifehacker.com/5794486/how-to-add-a-second-layer-of-encryption-to-dropbox

 

[bediwin]

I've always used Dropbox as my backup, not for anything important but perhaps I should reconsider. Any of you useful chaps able to recommend a decent secure backup service?

How secure do you need it?

If it's secure based on a key that you hold, then if that key is lost - so are your backups. Can you store the key safely offsite?

If it's secure based on your password, then it is no more secure than your password is. As soon as someone else finds out your password (spyware? password used for some other site that gets hacked?), they've got access to your backups.

 

[jfez]

I have used WinSCP sFTP in the past and have not had any issues. Used it for secure video file transfers for online video streaming service. Partners had to transfer files using secure keys.

 

[maxine]

This is such a shame.

I love Dropbox for convenience of sharing files between remote workers and customers but thankfully have always taken the view never to share anything in the cloud that could harm if shared openly.

I use it purely for convenience of current work files only and then have another backup and storage facility in place. I would have loved to have considered Dropbox for more sensitive stuff or for more volume to cut down on frequency of other archiving routines but there is no way I would do this now.

What get's me thinking though is that this was 4 hours of exposure where surely some robust regression testing should have been in place. This just screams sloppiness to me. If that's the case then it begs the question what else is sloppy. I might be over-reacting but if you pitch yourself as strong on security then it doesn't take much for that impression to start to crumble in the customers eyes.

Ii really hope they recover from this and don't think they have done themselves any favours by people finding out via blogs, forums, twitter and thinking the worst rather than a more formal communication to allay fears.

What steps are people taking now? Can anyone recommend easy to use encryption tools? Are people communicating policies etc with people they share folders with?

 

[RemoteTechs]

I have only ever used Dropbox to quickly access any "work in progress" (non important) files from my work desktops to my laptops, we use Office 365 so all of our shared company data is on our company SharePoint, where changes can be tracked properly etc.

 

[Page]

What about MS Skydrive

Is that any better

 

[Deleted member 74972]

Maxine
Take a look at using Truecrypt to create an encrypted disk in a file. Store the file in Dropbox and you have the best of both worlds: a strongly encrypted filesystem that replicates between your machines.
Beware however, there is a hit on the amount of data that gets transferred to and from Dropbox and you can't access the files through a browser.