back to article Dropbox Paper: Handy for collaborating... oh and harvesting email addresses, too

A security engineer has complained that a feature of Dropbox Paper, a document collaboration tool, leaks email addresses by design. Koen Rouwhhorst observed on Twitter that “If you share a Dropbox Paper document publicly, any viewer can see the full name and email address of any Dropbox user who ever opened that document, …

  1. John Crisp


    Bolloxs dropped.

    Great to remind myself of why I don't use them.

  2. Teiwaz

    Soon to be...

    Dropped Box.

  3. steelpillow Silver badge

    Security and privacy

    No question the default settings need to be the other way round. Requiring a user action in order to keep their personal details private is utterly unacceptable and, I dare say, illegal in many countries.

    I'd be marginally less unhappy if logging back in did not invoke quite so much cross-site scripting from the usual data-slurpers.

    Trouble is, who else (besides Google WhatIsYourBloodGroup) has an Android client where I can simply open an existing document in my private cloud workspace and start typing?

    1. veti Silver badge

      Re: Security and privacy

      Try opening an incognito browser session to view these documents. That should fix it.

      Still inconvenient, but it means you don't have to log out in your main session.

      1. steelpillow Silver badge

        Re: Security and privacy

        Thanks. I knew that (ahem).

  4. YetAnotherJoeBlow

    Lost their mind?

    Have all the adults left the building? I just can not imagine how their thought processes came to the conclusion that this is what everyone needs.

    1. Julz

      Re: Lost their mind?

      All the adults stopped using this sort of shit a long time ago; leaving the kids to make it up and play with it themselves.

  5. Anonymous Coward
    Anonymous Coward

    Another vendor with an over-inflated estimate of product value

    I had to re-install it on my laptop as a new client uses it. I'm sent Dropbox Paper email ads every day but haven't nibbled on the bait yet.

    Dropbox functionality isn't very impressive, and a business subscription is three-user minimum at around US$750 per year. Glad I'm not paying the freight.

  6. TonyJ Silver badge

    Seafile or OwnCloud.

    I know...old fashioned concept, but you control the data and who can access it/what is shared etc.

    I can understand the utility of the document owner seeing who has had access, but not world + dog + dogs fleas.


  7. Anonymous Coward
    Anonymous Coward

    I hear the sounds of lawyers hands rubbing together

    I just dropped DropBox. Killed my two paid accounts as they have changed the way symlinks are handled breaking my entire workflow. No notice they just did it. This was a reliable and responsible company years ago.

  8. Mr Dogshit

    La la la


  9. steviebuk Silver badge

    Bit like...

    ...when you share a fake PDF file via dropbox and convince loads of idiots to sign in to legit dropbox to click on the fake PDF. And then they all leave posts saying "Jane did you mean to send me this? Its not working" so I now get to see all the idiots that fell for the "Clearly a fucking phishing email because the owners mailbox was compromised" scam.

  10. fredesmite

    Remember - Cloud computing and document sharing

    Is nothing more that posting your crap on the same computers millions of other people are using and expecting the equipment owners to care more about it than you do

  11. Anonymous Coward
    Anonymous Coward

    Time to resurrect my ownCloud (or whatever it happens to be calling itself this week) setup.

    Or maybe treat myself to a NAS box.

    I've cancelled my Dropbox Business service largely because of the 20%+ price increase they tried to slip under the radar but also because even if I did use all of the space on offer I'd undoubtedly run into problems with backups/rehoming of data should everything go wahoonie-shaped. Whilst it was highly unlikely that I'd ever use Dropbox Paper, the fact that it hoovers data up doesn't surprise me in the least.

    In the immortal words of The Exploited: "Fuck 'em".

  12. Anonymous Coward
    Anonymous Coward

    My company uses a different SaaS product called Syncplicity

    We have left all of the dropbox type problems in the dust since we've started using Syncplicity. No more security holes and I can access my data anywhere with all the bells and whistles. Reading this just makes me feel better about my company's decision!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like