Thursday, February 10, 2011

A Conversation

FLG: You keep your bank statements in your dropbox folder?

Coworker: Yes.

FLG: What the hell for? Do you need them at every computer you use?

Coworker: No. It's an easy way to secure them.

FLG: Uh, no. It's not. It's an easy way to make an unencrypted copy on every computer you installed dropbox on.

Coworker: No, it's encrypted. Check the website.

FLG: Oh, it's encrypted when uploading between your computer and their server, when it's on their server, and then when it's downloading from their server to your other computers, but it's not encrypted when it's on your computers.

Coworker: FLG, it's on the website.

FLG: Let's check it.

Corworker: Okay, here we go. "Dropbox uses military grade encryption methods to both transfer and store your data."

FLG: To transfer and store, but not on your computer. Only when they store it.

Coworker: Wait, you're saying there's a copy on all of my computers? Aren't they in the cloud or whatever?

FLG: Can you access them on your laptop when you aren't on the Internet?

Coworker: Yes.

FLG: Then they aren't in the cloud.

Coworker: Okay, here we go. "All transmission of file data and metadata occurs over an encrypted channel (SSL)" and "All files stored on Dropbox servers are encrypted (AES-256)."

FLG: Yeah, like I said, it's encrypted when uploading between your computer and their server and then when it's downloading from their server to your other computers, but it's not encrypted when it's on your computers.

Coworker: "Dropbox website and client software have been hardened against attacks from hackers."

FLG: Okay, but that doesn't mean the files are encrypted on your computer.

Coworker: It doesn't?

FLG: No.

Coworker: So you are saying that my bank statements are on every computer I own and if somebody stole my laptop they'd be able to read them?

FLG: Yes.

Coworker: That's not good.

FLG: That's what I've been trying to tell you.

No comments:

 
Creative Commons License
This work is licensed under a Creative Commons Attribution-No Derivative Works 3.0 United States License.