Dropbox Paper: Handy for collaborating... oh and harvesting email addresses, too

A security engineer has complained that a feature of Dropbox Paper, a document collaboration tool, leaks email addresses by design. Koen Rouwhhorst observed on Twitter that “If you share a Dropbox Paper document publicly, any viewer can see the full name and email address of any Dropbox user who ever opened that document, …

[John Crisp]

Ooops

Bolloxs dropped.

Great to remind myself of why I don't use them.

[Teiwaz]

Soon to be...

Dropped Box.

[steelpillow]

Security and privacy

No question the default settings need to be the other way round. Requiring a user action in order to keep their personal details private is utterly unacceptable and, I dare say, illegal in many countries.

I'd be marginally less unhappy if logging back in did not invoke quite so much cross-site scripting from the usual data-slurpers.

Trouble is, who else (besides Google WhatIsYourBloodGroup) has an Android client where I can simply open an existing document in my private cloud workspace and start typing?

[veti]

Re: Security and privacy

Try opening an incognito browser session to view these documents. That should fix it.

Still inconvenient, but it means you don't have to log out in your main session.

[steelpillow]

Re: Security and privacy

Thanks. I knew that (ahem).

[YetAnotherJoeBlow]

Lost their mind?

Have all the adults left the building? I just can not imagine how their thought processes came to the conclusion that this is what everyone needs.

[Julz]

Re: Lost their mind?

All the adults stopped using this sort of shit a long time ago; leaving the kids to make it up and play with it themselves.

[Anonymous Coward]

Another vendor with an over-inflated estimate of product value

I had to re-install it on my laptop as a new client uses it. I'm sent Dropbox Paper email ads every day but haven't nibbled on the bait yet.

Dropbox functionality isn't very impressive, and a business subscription is three-user minimum at around US$750 per year. Glad I'm not paying the freight.

[TonyJ]

Seafile or OwnCloud.

I know...old fashioned concept, but you control the data and who can access it/what is shared etc.

I can understand the utility of the document owner seeing who has had access, but not world + dog + dogs fleas.

Also...GDPR?

[Anonymous Coward]

I hear the sounds of lawyers hands rubbing together

I just dropped DropBox. Killed my two paid accounts as they have changed the way symlinks are handled breaking my entire workflow. No notice they just did it. This was a reliable and responsible company years ago.

[Mr Dogshit]

La la la

GDPR

[steviebuk]

Bit like...

...when you share a fake PDF file via dropbox and convince loads of idiots to sign in to legit dropbox to click on the fake PDF. And then they all leave posts saying "Jane did you mean to send me this? Its not working" so I now get to see all the idiots that fell for the "Clearly a fucking phishing email because the owners mailbox was compromised" scam.

[fredesmite]

Remember - Cloud computing and document sharing

Is nothing more that posting your crap on the same computers millions of other people are using and expecting the equipment owners to care more about it than you do

[Anonymous Coward]

Time to resurrect my ownCloud (or whatever it happens to be calling itself this week) setup.

Or maybe treat myself to a NAS box.

I've cancelled my Dropbox Business service largely because of the 20%+ price increase they tried to slip under the radar but also because even if I did use all of the space on offer I'd undoubtedly run into problems with backups/rehoming of data should everything go wahoonie-shaped. Whilst it was highly unlikely that I'd ever use Dropbox Paper, the fact that it hoovers data up doesn't surprise me in the least.

In the immortal words of The Exploited: "Fuck 'em".

[Anonymous Coward]

My company uses a different SaaS product called Syncplicity

We have left all of the dropbox type problems in the dust since we've started using Syncplicity. No more security holes and I can access my data anywhere with all the bells and whistles. Reading this just makes me feel better about my company's decision!