How secure is Paper?

[coeio]

Anyone that has my url can view my notes without any credential....

If someone takes a picture of my screen or anotate my url can acesss my notes directly in any computer and all the links that it contains.

Is there any way to block my notes to avoid this?

thanks

[Mark]

Anybody with the link cannot view it. Only people authorised to view it can.

Remember though that if you view the link on a device you've Dropbox installed on you are automatically logged in and so it will open - as it knows its you.

To test it put the link through a device without Dropbox installed at all.

[coeio]

OK

I was able to open a link to my paper inside a virtual machine where I don’t have dropbox installed and was not logged in, but as you have said dropbox  knows that is the same computer...

Thanks

[coeio]

Hello, could you do a test...

Try to open this link:

https://paper.dropbox.com/doc/donotopen-yrBVHQJq2S7jQDx2qBaC9

If what you said is truth, you should not be able to open it...

But looks like this link is acessible for everyone with it!!!!! I testd using a proxy...

[Mark]

I stand corrected, something has changed and it is saying I can access it BUT I need an account to view the document and you are informed that I am viewing it. 

I'm going to do some digging....

[coeio]

Looks like that the URL comes with an auto-shareable code.

This is dangerous, is like having your password in the URL, and there are various forms to get it (taking pictures, filming, looking at it!...).

To you dropbox showed a button to open it “Open doc” but I think it showed this button because you have a dropbox account, if you test this link using a proxy or torbrowser where dropbox does not knows you it shows the document directly…

If this is a default behavior of dropbox I think it is insecure, mainly because I like to connect my papers with links (+doc1 +doc2), so if someone gets the url from my “index” they could have access to all my linked docs!

Thanks

[coeio · Accepted solution]

Someone from the drobox support explained me that you need to specify that only people invited to this doc can view the link, on the document sharing properties; this blocks the default behavior of leaving the link accessible by anyone with it.

This works but is annoying since you need to specify this in all documents that you create.

Ideally, the system should have an option to set this as the default behavior to all documents or something in this line.

More information visit https://www.dropbox.com/help/paper/sharing-permissions

Thanks….

[genepdx]

I just verified that even an "invite only" folder by default will make all docs inside world-readable.

Nice to see people finally admit this is the case so frustrating that so many people on these forums just argued with folks with no evidence. Is Dropbox the new Apple? 🙂

Back to Google Docs for me...

[genepdx]

And another correction to Mark's disinformation; "BUT I need an account to view the document and you are informed that I am viewing it. "

No you don't need an account. The url pulls up a view-only version of the content for anyone on the internet unless you specify (on a PER DOCUMENT basis after adding) to limit to your team.

[This thread is now closed. If you have a similar or new question, you can ask here.]