cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Want to learn some quick and useful tips to make your day easier? Check out how Calvin uses Replay to get feedback from other teams at Dropbox here.

Settings and Preferences

The Dropbox Community is here to help if you have questions about your account settings and preferences. Learn and share advice with members.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Password changed but user still has access?

Password changed but user still has access?

Gavin H.4
New member | Level 1

Hi - I have a dropbox account which I share with a few people. In effect a single dropbox login and a few people know the password. Some of these access it via the dropbox App. I have changed the password on the main dropbox account, thinking this will stop them accessing it, but a number still seem to have access to it? Bit concerned as I though once the password was changed they would lose their access.

12 Replies 12

Mark
Super User II

Bit concerned as I though once the password was changed they would lose their access.

No, you need to actively unlink those peoples Dropboxs from www.dropbox.com/account


 


:penguin::penguin: - :penguin: - :penguin: - :penguin:


Heart Did this post help you? If so please mark it for some Kudos below. 


:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Solution' button to help others find it.


:arrows_counterclockwise: Did this post not resolve your issue? If so please give us some more information so we can try and help - please remember we cannot see over your shoulder so be as descriptive as possible! 


 

Gavin H.4
New member | Level 1

Thank you for your help. That's really poor security though isn't it? Normally if you give someone access to your account by sharing the password, if you then change it they should not be able to get back into the account? Come on Dropbox that's a massive security hole?

Mark
Super User II

Normally you wouldn't give somebody access to your account though - its basic security. Would you give them access to your email? No. By giving them your password they could do ANYTHING at all to your account and you'd have no come back at all - permanently delete files, remove your access, change the password/emails, anything. And as you've given them your security you have basically made them co-owner and allowed them to do it.

Especially when there are inbuilt features to enable you to not need to do that (shared folders)


 


:penguin::penguin: - :penguin: - :penguin: - :penguin:


Heart Did this post help you? If so please mark it for some Kudos below. 


:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Solution' button to help others find it.


:arrows_counterclockwise: Did this post not resolve your issue? If so please give us some more information so we can try and help - please remember we cannot see over your shoulder so be as descriptive as possible! 


 

George H.33
New member | Level 1

This is a HUGE security hole.  You shouldn't have to manually unlink to force a new password be entered.

The right thing is that if a user changes a password, than the current credentials on ALL linked systems should be immediately revoked, and a request for an updated password generated.

While I'm at it, an option to automatically unlink systems idle for a user settable time would be good - I just checked and I had 4 old cell phones and 6 old computers still linked but inactive - I should have an automatic method of cleaning this up.

George H.33
New member | Level 1

To expand a bit more, the standard action if a security breakin is suspected is to change a password, but on dropbox, as currently configured that's useless - once a "bad guy" is in to your account, i.e. linked, changing a password does no good - you have to take the extra unlink step, which I would wager most users have never heard of.

Mark
Super User II

You shouldn't have to manually unlink to force a new password be entered.

Why? Its how most credentials work on machines. 

It would do my head in having to re-link everything I had every time I changed my password - especially as I'm the only person who uses the devices. 

I just checked and I had 4 old cell phones and 6 old computers still linked but inactive - I should have an automatic method of cleaning this up.

But that leaves the data on your devices. If you unlink via the website then you can ask Dropbox to wipe any data on it. You cannot do that if its unlinked. Nor could you track lost / stolen devices. 

you have to take the extra unlink step, which I would wager most users have never heard of.

Personally I disagree. Most modern syncing tools/similar set up programs work on secure tokens. Changing a password on 99% of iOS device applications does not cause the linked accounts to re-request it for example. 


 


:penguin::penguin: - :penguin: - :penguin: - :penguin:


Heart Did this post help you? If so please mark it for some Kudos below. 


:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Solution' button to help others find it.


:arrows_counterclockwise: Did this post not resolve your issue? If so please give us some more information so we can try and help - please remember we cannot see over your shoulder so be as descriptive as possible! 


 

George H.33
New member | Level 1

Most systems (e.g. windows) at least require a password entry on reboot - dropbox doesn't even do that - the old credentials are still valid across a reboot, at least on windows, and I suspect other platforms as well. 

As far as other platforms not invalidating tokens when passwords change, that doesn't make it right - in fact, the right (i.e. secure) way to do this is to ask on password reset if the current tokens, links, etc. be invalidated.  Just because other people jump off a cliff doesn't mean it's a good idea.  The basic rule of security is to err on the side of too much authentication, not too little!

George H.33
New member | Level 1

You are right about my auto unlink suggestion, but that's easily remedied - just add the option on the auto unlink to erase the data, and make it the default.  In my case, it's irrelevant - all of these devices are known to be dead or upgraded to new identities. 

As far as tracking lost/stolen devices - I don't see how dropbox can help there anyway.

Mark
Super User II

the old credentials are still valid across a reboot, at least on windows, and I suspect other platforms as well. 

It is, thats right, because Dropbox doesnt run on passwords - as was said, it runs on tokens. 

As far as tracking lost/stolen devices - I don't see how dropbox can help there anyway.

If a device logs in it keeps a record of the IP address. And I believe you can get security software that auto uploads images to Dropbox if people use/steal devices etc. 


 


:penguin::penguin: - :penguin: - :penguin: - :penguin:


Heart Did this post help you? If so please mark it for some Kudos below. 


:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Solution' button to help others find it.


:arrows_counterclockwise: Did this post not resolve your issue? If so please give us some more information so we can try and help - please remember we cannot see over your shoulder so be as descriptive as possible! 


 

Need more support?
Who's talking

Top contributors to this post

  • User avatar
    Rich Super User II
  • User avatar
    dh32405 New member | Level 2
  • User avatar
    George H.33 New member | Level 1
  • User avatar
    Mark Super User II
What do Dropbox user levels mean?