Reply to: Online Storage Help

[SimonMac]

I'm using DB as an alternative to SVN for my business docs which don't change much. Seems very well implemented.

Got to LOL at them offering 128Mb free add-ons though!

Every little helps!

[d000hg]

I'm using DB as an alternative to SVN for my business docs which don't change much. Seems very well implemented.

Got to LOL at them offering 128Mb free add-ons though!

[SimonMac]

For all those that signed up thank you, have also just found out that there are a few little bonuses for increasing storage:

https://www.dropbox.com/free

https://www.dropbox.com/edu

[Sysman]

It wouldn't kill them to implement a "New host xxxx has been added to your profile" email, would it.

I think they are probably working on that right about now

[Pondlife]

I've just looked in my account settings and didn't find any way to do this.

I did however look at the list of computers linked, and deleted some old virtual machines which no longer exist,. It's probably a good idea to log onto your account every now and then to check this list.

It wouldn't kill them to implement a "New host xxxx has been added to your profile" email, would it.

[SimonMac]

You would just remove the rouge host from the list of computers on the website

[Sysman]

It's not obvious to me how one actually revokes the credential.

I've just looked in my account settings and didn't find any way to do this.

I did however look at the list of computers linked, and deleted some old virtual machines which no longer exist,. It's probably a good idea to log onto your account every now and then to check this list.

[Sysman]

Hmmm interseting, although if someone has access to the host file don't they already have access to all your files anyway?!

Yes, but access to your credentials means that they could get at your future Dropbox contents. It's the idea that a password change isn't sufficient to prohibit access after a breach which worries me. It kind of invalidates the advice to change your passwords at regular intervals.

One thing puzzles me about the article:

If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords.

It's not obvious to me how one actually revokes the credential.

[SimonMac]

El Reg: Security researcher warns over Dropbox authentication security flaw



It doesn't take a Trojan. If you have Dropbox installed on a machine at work, your credentials can potentially be lifted from it when you are not there. Physical access beats all.

P.S. also read the comments. See the comment "Dropbox & Roaming Profiles = insecure"

Hmmm interseting, although if someone has access to the host file don't they already have access to all your files anyway?! I might look into adding TrueCrypt to parts of it though

[Sysman]

El Reg: Security researcher warns over Dropbox authentication security flaw

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

It doesn't take a Trojan. If you have Dropbox installed on a machine at work, your credentials can potentially be lifted from it when you are not there. Physical access beats all.

P.S. also read the comments. See the comment "Dropbox & Roaming Profiles = insecure"

[SimonMac]

http://www.dropbox.com/edu

If you have access to a *.ac.uk email address you get double referrals past and future )

[cojak]

Tips like that are worth remembering. Thanks.

Perhaps this can be moved to "Technical"?

Your wish...

[SimonMac]

Quick bump to say thank you to all those who signed up, and a boo/hiss those who signed up but didn't install the app so no referral bonus lol

[Mr.Whippy]

It may have no monetary value to you, but it does to dropbox. They offer the 2GB package as a taster to what they offer, the whole business revolves around people/businesses purchasing larger storage packages from them, not circumventing their business model.

This is something dropbox encourages users to do, so they get more users who may get the paid for service. It's hardly "circumventing their business model", you're a little OTT with that statement imo.

If you like it so much, why not sign up to the larger package and help keep them in business? It only works out to £5 a month. Two pints a month and you get to feel good that you're encouraging innovation like this.

Totally agree, it's peanuts for what is such a handy and useful service.

I sync pretty much everything to my dropbox and when BitLocker decided that it wouldn't unlock my drives without the recovery key I went to get it from my dropbox.... however something had changed and I'd forgotten to sync the latest key... so I had to rebuild the entire laptop, which consisted of clonezilla to restore the OS and apps and then dropbox to pull down all my files... simples, back up and running in record time... well worth the cost.

[Incognito]

it has no monetary value to me, it just give me extra storage space.

It may have no monetary value to you, but it does to dropbox. They offer the 2GB package as a taster to what they offer, the whole business revolves around people/businesses purchasing larger storage packages from them, not circumventing their business model.

If you like it so much, why not sign up to the larger package and help keep them in business? It only works out to £5 a month. Two pints a month and you get to feel good that you're encouraging innovation like this.