Dropbox passwords optional for four hours(techcrunch.com) |
Dropbox passwords optional for four hours(techcrunch.com) |
To me; it would make sense if Dropbox stored everything encrypted (as in, encrypted pre-transfer), and you needed the private key to decrypt stuff, unless you specifically state that it is to be public. It just makes sense from a liability statement. That said, you can do this anyway as recomended in this article. (http://lifehacker.com/5813873/how-to-add-a-second-layer-of-e...)
You can say that google might leak your emails, but the same is true if you use your private email server.
That's still wholly untenable for the real world, but not all paranoid people live in the real world per se.
Grandalf's point is extremely well taken. It's actually true. Not only that, but regulated companies (in health care and finance) that have a reasonable belief that any of their systems might have had Dropbox on them technically need to audit now.
I point this out not to bag on Dropbox, but as an illustration of how sane some unreasonable-sounding IT policies (like, "you don't get to install random software on your desktop") turn out to be.
† (Or Tarsnap or SpiderOak, for what it's worth.)
(WebDAV isn't "support," when you look at the Dropbox/SpiderOak feature set.)
Another thing to do would be to change the design of the authentication process so that it is more inherently fail-closed. For instance, you could encrypt/decrypt the database ID of the user with a key derived securely and deterministically from the user's password, perhaps (just to keep the code simple) after verifying the password against a secure password hash.
illustrated example: billgates twitter account: " Do you want me to give you all my money or what lolz" techcrunch : "OH MY GOD, BILLGATES PLANING TO GIVE A WAY ALL OF HIS MONEY" and later : "OH MY GOD, HERE'S THE GUY BILLGATES WAS TALKING ABOUT" I mean seriously, I just hate buzz seeking journalists.
If this happens, let's look forward to a trove of blogposts about "how to make dropbox secure" from armchair CTOs, just like we saw with Twitter and the string of posts around "How I'd scale twitter" Sharding! Webscale!
On the part of the _users_ of dropbox, I have empathy; In part of those running their medical/finance business on assumptions of dropboxes security, I have nothing but emnity.
† Ok, no I don't
EDIT: To phrase less hostilely -- HIPAA and various finance laws consist of thousands of pages of what to do and what not to do. Dropbox is a shiney webpage that isn't PCI certified or HIPAA certified. If you chose to operate in a business that requires HIPAA/PCI, and used dropbox for that data, _you_ are at fault, not dropbox, not the bofhs, and not the coder. In the case of HIPAA - you would be the criminal.
I admit readliy it's mostly the problem of bad luck (being targeted) or careless (losing emailed reports w/ identifying data <g>) - but if and when that drug company gets sued for something like that, guess which side the law will be on?
Still, complying with HIPAA does make one point _very_ clear -- audit controls - Dropbox has none exposed to you, and thus it simply does not comply unless you have your own layer of controls (encryption) on top.
It also seems to fall down under 'Standard: Person or entity authentication' as well, but that's just me being snarky.
Health-care and finance are places with legal (or contractual) obligations -- and that was my main point: if you have a set of rules (or even best practices), and you fall afowl of them, don't go screaming that someone else is to blame.