cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Share your feedback on the Document Scanning Experience in the Dropbox App right here.

Create, upload, and share

Find help to solve issues with creating, uploading, and sharing files and folders in Dropbox. Get support and advice from the Dropbox Community.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Security of Dropbox links

Security of Dropbox links

tchambers
Helpful | Level 6
Go to solution

It occurred to me today when I Ducksearched to find a public Dropbox link https://www.dropbox.com/s/br7d9jigsldnvjy/ [1] that Dropbox appears to be practicing Security Through Obscurity. What prevents brute-force attacks from guessing the br7d9jigsldnvjy part of the URL to find any shared file from anyone?

 

1 Accepted Solution

Accepted Solutions

tchambers
Helpful | Level 6
Go to solution

Thank you for pointing me in the right direction, Daphne. I studied more and experimented, and now I understand. I was already aware of the security features available when sharing with individuals and groups. I did not understand in particular how "Copy Dropbox link" in Windows Explorer worked. The Shared > Links tab is what concerns me. People may not understand that when they share either a file or a folder via link, they are relying on Security Through Obscurity. Bad actors can brute force guess these links. It would be nice if Dropbox reassured us that they detect malicious patterns and block requesters. At least that would slow down brute force attacks. I sleep better knowing I can simply delete the link in the web app. If I want to re-share the file or folder I can create a new link.

 

Therefore, with prudence, share-by-link is a convenient feature. Not a problem if the content is not sensitive. However, if one needs a long-term link to a file or folder that contains sensitive information, it is advisable to share with explicit users or groups instead. If for some reason that is not convenient, one should periodically make a new copy of the shared folder or file and should overwrite the existing content accessible from the shared link with a generic message such as, "The link to this content has expired. Reach out to the person who shared this link with you and ask them for a new link." Otherwise one may not sleep well at night trusting one's content will not be discovered with a brute force attack.

View solution in original post

9 Replies 9

Daphne
Dropbox Staff
Go to solution

Hey @tchambers, thanks for posting!

 

Additional security can be added to shared links by changing the settings and permissions of the links. You can check out more info about this here.

 

For example, a password can be added to a shared link and Business teams can restrict access to only team members.

 

I hope this info helps, let me know if you have any questions!


Daphne
Community Moderator @ Dropbox
dropbox.com/support


Heart Did this post help you? If so, please give it a Like below.
:arrows_counterclockwise: Still stuck? Ask me a question!
:pushpin: Tips & Tricks Find new ways to stay in flow or share your tips on how you work smarter with Dropbox.

tchambers
Helpful | Level 6
Go to solution

Thank you for pointing me in the right direction, Daphne. I studied more and experimented, and now I understand. I was already aware of the security features available when sharing with individuals and groups. I did not understand in particular how "Copy Dropbox link" in Windows Explorer worked. The Shared > Links tab is what concerns me. People may not understand that when they share either a file or a folder via link, they are relying on Security Through Obscurity. Bad actors can brute force guess these links. It would be nice if Dropbox reassured us that they detect malicious patterns and block requesters. At least that would slow down brute force attacks. I sleep better knowing I can simply delete the link in the web app. If I want to re-share the file or folder I can create a new link.

 

Therefore, with prudence, share-by-link is a convenient feature. Not a problem if the content is not sensitive. However, if one needs a long-term link to a file or folder that contains sensitive information, it is advisable to share with explicit users or groups instead. If for some reason that is not convenient, one should periodically make a new copy of the shared folder or file and should overwrite the existing content accessible from the shared link with a generic message such as, "The link to this content has expired. Reach out to the person who shared this link with you and ask them for a new link." Otherwise one may not sleep well at night trusting one's content will not be discovered with a brute force attack.

Lusil
Dropbox Staff
Go to solution

Thanks for the additional information, @tchambers. We really appreciate you notifying us about this.

 

Could you also follow the process outlined on this article to report this to us officially?

 

You can also have a look through this blog post for more details on our program.

 

In the meantime, if anything else comes up, don't hesitate to get back to us. Thanks again


Lusil
Community Moderator @ Dropbox
dropbox.com/support


Heart Did this post help you? If so, please give it a Like below.
:arrows_counterclockwise: Still stuck? Ask me a question!
:pushpin: Tips & Tricks Find new ways to stay in flow or share your tips on how you work smarter with Dropbox.

tchambers
Helpful | Level 6
Go to solution

The task of submitting a formal vulnerability report looks like a non-trivial effort, @Lusil. STO is a basic principle, and I am surprised Dropbox has not done its own vulnerability assessment that justifies its use of this public link-sharing approach. Anyway, it may be some time before I can concentrate on the task. Do you have an opinion about what level of risk my observation represents to Dropbox's security? That will help me prioritize the task.

Lusil
Dropbox Staff
Go to solution

I'm afraid I'm not able to determine the level of risk, until one of our security experts is able to review your report in its entirety. 

 

I understand that this may not be the ideal reply you were looking for, but let me know if you have any other questions. 

 

Thanks, @tchambers!


Lusil
Community Moderator @ Dropbox
dropbox.com/support


Heart Did this post help you? If so, please give it a Like below.
:arrows_counterclockwise: Still stuck? Ask me a question!
:pushpin: Tips & Tricks Find new ways to stay in flow or share your tips on how you work smarter with Dropbox.

tchambers
Helpful | Level 6
Go to solution

Fair enough. I'll file a report.

dlcmc
Explorer | Level 4
Go to solution

Thaank you for this.

tchambers
Helpful | Level 6
Go to solution

I have not yet filed the report. It is still on my to-do list.

tchambers
Helpful | Level 6
Go to solution

I finally submitted my report to HackerOne: #1541730 tbcj0414a

Need more support?
Who's talking

Top contributors to this post

  • User avatar
    tchambers Helpful | Level 6
  • User avatar
    dlcmc Explorer | Level 4
  • User avatar
    Lusil Dropbox Staff
What do Dropbox user levels mean?