Online Storage Help

[cojak]

Tips like that are worth remembering. Thanks.

Perhaps this can be moved to "Technical"?

Your wish...

[SimonMac]

http://www.dropbox.com/edu

If you have access to a *.ac.uk email address you get double referrals past and future )

[Sysman]

El Reg: Security researcher warns over Dropbox authentication security flaw

The Windows config file might be lifted after a machine becomes compromised via a Trojan, the most obvious attack scenario. If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords. Users will not be informed if a new computer is added to a synchronisation list.

It doesn't take a Trojan. If you have Dropbox installed on a machine at work, your credentials can potentially be lifted from it when you are not there. Physical access beats all.

P.S. also read the comments. See the comment "Dropbox & Roaming Profiles = insecure"

[SimonMac]

El Reg: Security researcher warns over Dropbox authentication security flaw



It doesn't take a Trojan. If you have Dropbox installed on a machine at work, your credentials can potentially be lifted from it when you are not there. Physical access beats all.

P.S. also read the comments. See the comment "Dropbox & Roaming Profiles = insecure"

Hmmm interseting, although if someone has access to the host file don't they already have access to all your files anyway?! I might look into adding TrueCrypt to parts of it though

[Sysman]

Hmmm interseting, although if someone has access to the host file don't they already have access to all your files anyway?!

Yes, but access to your credentials means that they could get at your future Dropbox contents. It's the idea that a password change isn't sufficient to prohibit access after a breach which worries me. It kind of invalidates the advice to change your passwords at regular intervals.

One thing puzzles me about the article:

If stolen, the host_id config file can used on any other system and the breach can only be resolved by logging into an account and revoking this credential rather than simply changing passwords.

It's not obvious to me how one actually revokes the credential.

[Sysman]

It's not obvious to me how one actually revokes the credential.

I've just looked in my account settings and didn't find any way to do this.

I did however look at the list of computers linked, and deleted some old virtual machines which no longer exist,. It's probably a good idea to log onto your account every now and then to check this list.

[SimonMac]

You would just remove the rouge host from the list of computers on the website

[Pondlife]

I've just looked in my account settings and didn't find any way to do this.

I did however look at the list of computers linked, and deleted some old virtual machines which no longer exist,. It's probably a good idea to log onto your account every now and then to check this list.

It wouldn't kill them to implement a "New host xxxx has been added to your profile" email, would it.

[Sysman]

It wouldn't kill them to implement a "New host xxxx has been added to your profile" email, would it.

I think they are probably working on that right about now

[SimonMac]

For all those that signed up thank you, have also just found out that there are a few little bonuses for increasing storage:

https://www.dropbox.com/free

https://www.dropbox.com/edu