Dropbox Lack of Security
I am a fan of Dropbox. It is a great tool, a great product, and clearly they have a passionate team over at Dropbox building the product. — Dropbox recently announced an update to its security terms of service in which they announced that they would provide …
Context & Ripple Effects
Miguel de Icaza's post is a fan's objection rather than a rival's hit piece — he opens by calling Dropbox 'a great tool' with 'a passionate team,' then takes aim at the updated security terms disclosed a day earlier, under which Dropbox stated it would decrypt and turn over user files when the government asks. The story's reach was modest — one syndicated reprint beyond Silicon Alley Insider — but the substance cuts against how a sync service markets itself.
The timing matters: Dropbox came into 2011 in aggressive growth mode, with cofounder and CTO Arash Ferdowsi discussing major new features and global expansion plans in January, mobile apps shipped since mid-2010, and the company already cited as a freemium business-model case study back in March 2010. A service positioning itself as where users keep everything has just clarified the limits of its privacy promise.
First-order effects
- Dropbox users who assumed their stored files were unreadable to the company learn otherwise: the updated terms confirm Dropbox retains working decryption capability and will exercise it on government request.
- For Dropbox, an abstract compliance question becomes a live trust problem at the exact moment it is courting mainstream and paid users following its Android, iPad, and API launches in 2010.
Second-order effects
- Rival sync and cloud-storage providers face forced clarity: anyone marketing encryption must now answer whether it, like Dropbox, holds the keys — turning terms-of-service fine print into a competitive differentiator and a sales objection.
- Business and professional users weighing Dropbox for sensitive work gain a concrete due-diligence question — key custody and legal-disclosure policy — that did not previously surface in vendor evaluations.
Third-order effects
- If disclosure becomes the norm, consumer cloud storage splits structurally between providers built to comply by design (holding keys, honoring requests) and zero-knowledge providers selling the absence of exactly that capability, with the dividing line drawn by legal obligations rather than engineering preference.
The trend: Consumer cloud storage is shifting from a sync-and-storage feature race to a trust contest, in which what a provider must surrender to governments becomes part of the product specification.