Here is a post from 2 years ago explaining that they have access to private keys, don't do client side encryption, etc.

http://forums.dropbox.com/topic.php?id=7421&replies=14#p...

And anyone who wants those features should be using something like http://www.wuala.com/

What's with all the anti-DropBox hostility lately? Is it because they're doing well?

of course man. when people get so up in arms about something like this, it's because you've built something people love.

it's crappy to be on the receiving end, but the silver lining is that you've done something people truly care about.

Hey look, another blog bad mouthing dropbox. And with incorrect information. Dropbox obviously has keys to decrypt user files because 1) dedupe. And 2) the web interface.

This blog and any other that says dropbox was misleading/lied is doing it for pageviews or out if ignorance.

Dropbox having policies against snooping along with no implemented access is satisfying enough for me to meet their old security policy.

Sensationalism. There are many explanations for this more likely than dropbox was intentionally deceiving its users, and the Cory Doctorow knows that. Privacy is an engineering problem as much or more than a policy problem, and Dropbox, still being a relatively small company, is obviously going to have a hiccough or two before things are rock-solid.

It's kind of obvious dropbox wasn't storing raw file blocks encrypted, or there wouldn't be much point in doing dedupe -- any reasonable crypto algorithm should be giving you output close enough to random that two users storing the same data with different keys would not dedupe with each other.

So unless they were only deduping two copies of the same file blocks if they were stored with the same key, at least the data blocks are being stored plain.

As for who can access the fact that a given block is yours -- well, they still make substantially better promises than most ISPs or hosting companies do.

So yeah. Have reasonable expectations about how private data there is, and decide what to store there accordingly -- and if, before this change, you were expecting them to fight a warrant for you (or even say no if threatened with one) rethink your plan.