Dropbox drops ball on security

John Moe Jun 21, 2011

There was a four hour window on Sunday, where if you wanted to sign into somebody’s Dropbox account all you needed was their email address. Type in any password and you were in. The bug appeared after an update to their system. According to Dropbox, once the bug was identified, everyone who was logged into an account was immediately logged out. The company less than 1% of users had their accounts accessed in this way.
Still, this nicely illustrates a kind of tricky situation. Of course, this shouldn’t have happened and if you’re going to run a site like this you should be extremely careful about security considering how much information people store on Dropbox. On the other hand, as long as you have the weak link known as humans running things, are situations like this inherently unavoidable?

As a nonprofit news organization, our future depends on listeners like you who believe in the power of public service journalism.

Your investment in Marketplace helps us remain paywall-free and ensures everyone has access to trustworthy, unbiased news and information, regardless of their ability to pay.

Donate today — in any amount — to become a Marketplace Investor. Now more than ever, your commitment makes a difference.