Dropbox caught with its finger in the cloud cookie jar

Last month I wrote about a small security problem with ultra-popular cloud file storage and sharing service Dropbox. Because of a bit of lazy programming by the Dropbox devs, copying a file from one computer to another eliminates the necessity to log on to Dropbox with your password on the second computer. It isn’t a huge security hole because a potential cracker has to be able to get onto your computer in order to grab the file.

This is a completely different problem — a much bigger problem.

Sharp-eyed doctoral candidate Christopher Soghoian caught Dropbox in a bit of, uh, let’s call it an inconsistency. Here’s what he found.

When you set up a Dropbox account, you establish a folder on your PC that’s shared and synced with similar folders on other PCs, Macs, iPads, mobile devices, whatever. You brand the folder and its contents with an email address and a password. To get into the folder — online on the Dropbox website, or on another computer, pad, or smartphone — you have to provide the correct email address and password.

When I wrote the original article — indeed, when I started using Dropbox — I assumed that I was the only person with the password for my folder. Wrong.

Soghoian found an anomaly. Even though Dropbox claimed, “All files stored on Dropbox servers are encrypted (AES-256) and are inaccessible without your account password.” Yet the company also claimed, “If we detect that a file you’re trying to upload has already been uploaded to Dropbox, we don’t make you upload it again. Similarly, if you make a change to a file that’s already on Dropbox, you’ll only have to upload the pieces of the file that changed.”

How, Soghoian asked, could Dropbox find duplicate files — or detect which pieces of a file had changed — if it didn’t have access to the contents of those files? Dropbox responded with a resounding thud.

On April 12, the Dropbox help site said:

Dropbox employees aren’t able to access user files, and when troubleshooting an account, they only have access to file metadata (filenames, file sizes, etc. not the file contents)… All files stored on Dropbox servers are encrypted (AES-256) and are inaccessible without your account password.

Soghoian published his findings on April 12. Starting on or before April 14, Dropbox changed that help page, and changed it again on April 23, so it now says:

Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata… we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy (e.g., when legally required to do so). But that’s the rare exception, not the rule. We have strict policy and technical access controls that prohibit employee access except in these rare circumstances… All files stored on Dropbox servers are encrypted (AES-256)

A little different, eh?

Dropbox followed up on April 21, discussing employee access to encrypted data, and explaining changes to its Terms of Service Agreement, including this new TOS provision:

We may disclose to parties outside Dropbox files stored in your Dropbox and information about you that we collect when we have a good faith belief that disclosure is reasonably necessary to (a) comply with a law, regulation or compulsory legal request; (b) protect the safety of any person from death or serious bodily injury; (c) prevent fraud or abuse of Dropbox or its users; or (d) to protect Dropbox’s property rights.

Yes, you read that correctly. Dropbox now asserts that it can decrypt and pass your data on to a third party if Dropfox feels it needs to do so, in order to protect its property rights.

As a result, Soghoian has filed a 16-page complaint with the U.S. Federal Trade Commission, which asks the FTC to have Dropbox admit that it can get at Dropbox data, making your data vulnerable to an attack on Dropbox’s servers; require Dropbox to email its 25 million customers to warn them of the potential problem and suggest that customers encrypt their data independently; force Dropbox to refund money to people who paid for “Pro” service, if they felt they were deceived; and enjoin Dropbox from making future deceptive statements.

This article, “Dropbox caught with its finger in the cloud cookie jar,” was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest business technology news, follow InfoWorld.com on Twitter.