Tips by Tony

In case you hadn’t heard, Dropbox had an error during a system update yesterday that allowed people to access Dropbox accounts without a password. The glitch lasted about four hours before it was fixed. A SNAFU of this type is very serious, but I’m not really worried. Here’s why:

1. I don’t have any confidential information stored in my Dropbox account, unless it’s encrypted. In fact, if someone where to have accessed my Dropbox account yesterday, they likely would have been bored to tears at the files they found. Bottom line: don’t store any confidential information in Dropbox (unless it’s encrypted). More on encryption in a bit.
2. The only confidential information I do store in Dropbox is my 1Password data file, which is encrypted automatically by 1Password. So, if someone would have gained access to this file, it would be a very, very long time (if ever) until they were able to crack the encryption.
3. I checked the events log on the Dropbox website, and found that nobody had accessed or downloaded any of my files. There were no events in the log between 1:54pm PST and 5:46pm PST, the duration of the security breach.
4. Did I mention that I don’t have any confidential information stored in Dropbox?

Encrypting Files

If you insist on storing confidential or sensitive files in Dropbox, make sure the files are encrypted. Some files, like the 1Password data file I mentioned earlier, are encrypted automatically by the application that created them. Most files are not encrypted by default, however. If you really, really, really must store sensitive information, look into using something like TrueCrypt (Windows/Mac/Linux) – here’s an article describing using TrueCrypt with Dropbox – or use some other method such as encrypted zip files or encrypted sparse images. I’ll leave it up to you to research how to use such tools. For me, it’s far easier to simply not store confidential information in Dropbox. (Do I sound like a broken record? Good.)

The fact is, as we move more and more of our information from device to device, service to service, hiccups like the recent security SNAFU are going to happen. By thinking ahead, you can minimize any potential damage.

No related posts.