The good, bad & ugly of Dropbox authentication error

Businesses need to review cloud permissions and policies in light of online file storage security mishap

Online storage service Dropbox made an embarrassing error Monday, turning off password authentication for millions of users.

The company updated some code on the service just before 2:00 pm Monday, yet the new code included a bug that switched off the need to authenticate to access files on a Dropbox. This means that every file on every Dropbox could have been accessed without requiring any credentials to do so. The company figured out what it had done just before 6:00 pm and quickly closed the hole, but for four hours, users' documents were readily accessible to anyone who was looking.

It's the latest black eye for security in a cloud-based world, following on the likes of Sony's PlayStation Network debacle and other LulzSec shenanigans and high-profile downtime for cloud giants like Amazon.

But, if you'll pardon the pun, they say there's a silver lining to every cloud. So let's start by taking a look at what went right in this instance, and then get into what went wrong.

The Good: Transparency

Dropbox was upfront with this miscue, with CTO Arash Ferdowsi explaining the problem, what caused it, how it was fixed and who was affected in a Monday evening blog post. The company says that "as much as one percent" of its 25 million-plus user accounts were accessed during the security outage.

Since then, it has twice updated that post with the latest information, and says it is sending email to any accounts accessed during the four-hour breakdown with details of activity for user review.

As with any new technology, making sure users trust the cloud is key to its uptake and therefore usage. Amazon took a beating for its silence during its April AWS outage, and justifiably so. By getting out front of this issue, Dropbox minimized the damage to its brand and product and probably made it more likely that users will trust it in the future. So that's good.

The Bad: A Troubling History

However, if Dropbox has a heightened level of sensitivity around security issues, it's probably well deserved. In recent months, the company has been criticized for misleading users about the level of encryption is uses and had an FTC complaint filed against it for the same problem. And for good measure, it's been called out for its stance on handing files over to authorities upon request.

Any one of those problems could be reason enough for a business to stay away from the service. But the fact that all of them--including Monday's little oopsie--occurred over the last 12 weeks should have business owners and IT managers thinking about other options or crafting policies on what can, and more importantly cannot, be stored in a Dropbox account.

The Ugly: Leaving The Door Unlocked

This week's error is particularly onerous. It's not good that encryption isn't up to snuff and it's even worse if Dropbox tried to mislead its users about that. And although it's common policy in cloud services' terms of service, it's disquieting to think that your data can be handed over to the government without your knowing.

But turning off password authentication? That's a whole new level of troubling.

It's sort of like a landlord that promises some level of physical security leaving the doors to your office unlocked overnight.

It's unacceptable that this bug made it into production. Even if only one in 100 Dropbox users' access accounts were accessed during that time, 100 in 100 users' accounts were at risk. And even accepting Dropbox's low estimates, that still means that data from 250,000 users was out there, unprotected.

The Upshot: More Cloud Questions

At a time when small businesses are confused about the cloud and what it has to offer, blatant but avoidable errors do nothing to quell those concerns and fears.

For small businesses, it points out the need to be wary of free or low-cost online services, to do due diligence on any services that you're allowing users to build into their workflows, and to have policies in place that dictate what services can be used and with what types of data.

Dropbox and other tools like it can offer tremendous boosts in productivity, particularly in an era where more users are connecting to work through more devices than ever before. But tools that are meant to be consumer-grade need to be thoroughly examined and the risks understood before any kind of sensitive business data is allowed onto the cloud.

Errors like this are going to happen. That's nearly impossible to avoid as cloud providers scramble to scale and add new features. Businesses need to decide where to draw the line in balancing convenience with security.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicesapplication developmentWeb services developmentWeb-based ApplicationsapplicationsdropboxUtilitiesweb servicesinternetdata protectionsecuritybackupsoftwareencryption

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert Dutt

PC World (US online)
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?