News for hackers. Stuff that matters.

A comment on Dropbox Lack of Security. Parent comment

Re:Dropbox Lack of Security by tlrobinson on Tuesday April 19, 2011 @01:37AM (#2461741)
Yes, I read that article too. That information leakage vulnerability can be eliminated by requiring the user always upload the file the first time they store it. Subsequent uploads of the same file for the same user could be skipped. De-duplication across users in storage is also possible without leaking information.

What is not possible (AFAIK) is the combination of the two requirements: 1) de-duplication across users, and 2) service provider is not able to decrypt your files. The latter requires the encryption/decryption be done on the client only (service provider doesn't have the keys at all). The former requires access to the unencrypted file, or for the clients to share keys.

[ Parent | on HN ]
Re:Dropbox Lack of Security by bdhe on Tuesday April 19, 2011 @02:30AM (#2461852)
You can do (1) and (2) but it is not trivial to prove that it works. See: http://news.ycombinator.com/item?id=2461713
[ Parent | on HN ]
Re:Dropbox Lack of Security by tlrobinson on Tuesday April 19, 2011 @04:02AM (#2461972)
Clever. I like it.
[ Parent | on HN ]