Dropbox Paper Security Issue

[Ruslan_Taghiyev]

Everybody with the link to my paper file has access to it even if I didn't grant it.

How to reproduce:

1. Create a new paper file(do not share it somehow)

2. Copy the URL from the browser

3. Open this URL in the incognito mode(Or anywhere where you are not logged in)

Expected:

- 404 or 403

Actual:

- The page opens and you can view the file

PS: I've searched how to open a bug, or contact Dropbox support, but looks like you can't do it if you don't have a business account.

[Walter]

Hi @Ruslan_Taghiyev - thanks for taking the time to share your thoughts on this on our Community.

While Paper has a setting that allows anyone with the link to access a Paper doc, we warn users who try to access a doc owned by another team or a user not on their team that their information will be visible in a screen that pops up before the Paper doc loads. 

Displaying this information is needed to enable collaboration and security features for our users. Users and admins can control who can view a Paper doc in our settings. 

For more information you can take a look here. 

I hope this helps a tad. 

[Ruslan_Taghiyev]

Hi Walter, thanks for the fast answer!
So as I understand, by default, all my documents are shared with anyone who has a link?

That's pretty odd to me because in the docs list it says "Shared with": "Only you".

But it's not true, because until I go to the document settings and set "Unshare file" it's shared with anyone even without asking them to sign in, so I can't even know who viewed my file.

I think it's very misleading and from my experience document should be shared only after you enable this sharing manually, not by default, that is why I thought it was a bug. Is there some setting that I can enable so that all my documents will not be shared by default?

[Jay · Accepted solution]

Hi @Ruslan_Taghiyev, we appreciate the feedback about the sharing of Paper files. Currently, it isn't possible to prevent the default sharing of all your Paper documents. 

[Ruslan_Taghiyev]

Hi Jay, I'm sorry to hear that, but thank you for the information