Need to see if your shared folder is taking up space on your dropbox 👨💻? Find out how to check here.
Forum Discussion
Solved
Desktop/mobile client syncing after password change: security flaw?
Last week I've change my password though the website, at work. On my home computer I have installed the Desktop client. I have not changed a thing and it was syncing without problems.
The same happened with my Dropbox App for my Android phone.
If I ever change the password of my account I was expecting the need to update it everywhere I use it. If, by any change, somebody uses a Desktop/Mobile client and I change my password, this person would be able to keep on using it without problems.
From my point of view, unless I'm missing something, this is a security flaw that must be corrected.
Hope to hear from Dropbox team.
techs2017 if somebody has your password then installing Dropbox is the least of your worries.
Super Users are not employees but the answer is the official one - this isnt a security flaw. Its by design.
When somebody adds Dropbox to their computer you receive an email telling you this has happened, unless you've disabled those security emails in the Account section.
Also, if they did do that then you can unlink the account via the same Account page. For Plus and Business users you can also request that a remote delete is done while unlinking clients.
12 Replies
Replies have been turned off for this discussion
Even Microsoft has abandoned the obsolete security practice of changing passwords frequently and it's no longer part of their security baseline. It's been in the news for some time.
In this case, Dropbox handles this poorly. Everywhere else, changing a password in one place requires updating it everywhere else. It is far too easy to miss a place, and checking some random list (this is the first I've heard of it, and I've been using Dropbox for years) that isn't prominently displayed and part of the onboarding tutorial is both a UI mistake as well as a policy mistake. Companies should always act in the best security interests of customers, and allowing a token to continue operating is a direct contradiction.
Please revisit this decision.
Thank you.
- Jane
Dropbox Staff
