Dropbox has been forced to rectify its security clauses, by demonstrating that it does not adequately protect the files of users, or at least, not as the company initially announced on its website.
Dropbox is an online file hosting service "in the cloud" widely used (25 million users), which thanks to the previous analysis of the hash allows you to save space: if you try to upload a file whose hash is already present in Dropbox (in the account of another user by ...Dropbox has been forced to rectify its security clauses, by demonstrating that it does not adequately protect the files of users, or at least, not as the company initially announced on its website.
Dropbox is a widely used online file hosting service "in the cloud" (25 million users), which thanks to the previous analysis of the hash allows you to save space: if you try to upload a file whose hash is already present in Dropbox (in the account of another user for example), the system simply links to it without having to upload it again. Dropbox's security is based on AES256 encryption with key created and hosted on its own servers.According to the formal complaint filed with the US Federal Trade Commission (FTC) by researcher Christopher Soghoian, Dropbox lied to users when it advertised its service as fully encrypted and, as they announced, "without internal access of the company to the content of the same".
As the information became public, Dropbox has been modifying the encryption information clauses:
These rectifications by Dropbox have motivated Soghoian's attempt to get the FTC to investigate the company for its dubious security policy and get it to correctly warn the user of the true level of it.
Until the matter is clarified, the only possible solution to fully secure the data is to encrypt it locally when uploading it to Dropbox or directly use alternative services such as SpiderOak or Wuala.
Source: Hispasec
