Jon H. is shocked at the lack of
security in Dropbox’s product, and thinks Microsoft’s Intune has finally become
useful
Dropbox is one of those products that can
get under your skin. Once you start using it in anger you’ll find its
combination of “just enough power” coupled with an “invisible in daily use” UI
is entirely compelling. It’s one of those rare products that just works. But,
of course, it isn’t the only game in town: after all the recent work and
improvements, there’s much to like about Microsoft’s SkyDrive too. Not only
does it give you cross-platform clients and a decent amount of free storage,
but the online web application story is very strong too. The same can be said,
plus or minus a few bits, about Google Drive, depending on how much of your
life is spent inside Google’s world as opposed to Microsoft’s.
Dropbox
for teams: suitable for business?
Dropbox doesn’t try to offer any of these
added gewgaws, concentrating instead on what it does well. It’s had hiccups,
and no-one can deny the punishing times it went through following a nasty
security breach and several licensing snafus in the past. Some maintain that its
lack of user-created encryption means it shouldn’t be used for anything
remotely confidential. I’d certainly prefer to be able to generate my own
encryption keys and feed them into Dropbox’s client to ensure end-to-end
encryption. I’d be happier still if I could use the excellent 1Password to help
me do this. Maybe one day.
Having said all this positive stuff, I’ve
just had a bumpy month with Dropbox. First, I ran out of disk space, not in the
cloud but on the local SSD in my iMac. For reasons that must have made sense at
the time, I purchased this iMac with only 256GB of SSD storage after all, it
has two 12TB external drive arrays connected via Thunderbolt, so there was no
need to buy any more internal storage, I thought. How wrong I was.
Getting Dropbox to act as the replication
tool for 1Password is incredibly powerful, but it works on current versions of
OS X only if your 1Password is help in a folder on the local OS drive and that
means Dropbox’s own storage has to be on the local OS drive too. Once you have
100GB or more of data in your Dropbox folder, this can become a real problem.
I’ve managed to clean up some space on the
boot SSD by moving my music, film and TV library onto one of those RAID arrays
and turning off the feature in iTunes that says “Copy files to iTunes Media
folder when adding to library”. That keeps all iTunes files away from my boot
SSD, but even that wasn’t enough. In desperation, I’ve had to give up using
1Password integration with Dropbox.
Fortunately, I’ve already set up a raft of
1Password secure logins for the sites I regularly use, so that rate of change
in its store is now very low. This means it isn’t too much of a chore to
manually copy the file around the place or rather to manually drop it into a
Dropbox folder occasionally and let it do the machine-to-machine replication. I
have asked the vendors involved whether this feature will be sorted out soon,
but all I see is finger-pointing between Dropbox, 1Password and Apple (which
doesn’t even seem to want to reply).
Dropbox
is one of those products that can get under your skin
That’s one glitch. Now for my other
problem. Dropbox has a Teams version of the product. Instead of providing the
200GB of storage I had in my original account, the Teams version comes with 1TB
of storage and up to five accounts. You can migrate your existing users and
they magically join the team, bringing all their data with them. Obviously,
their data stays private unless they want to share it.
Teams are controlled and managed via the
Team button on the website. Here in can see the list of accounts, monitor how
much storage each is consuming, and set up two-stage verification if necessary.
A critical part of sharing in a business
environment is controlling who shares what with whom. When I saw what had been
implemented, my jaw dropped and bounced three times off the floor. Basically,
there’s very little difference between ordinary Dropbox and Dropbox for Teams
as far as sharing goes. I’d hopes the Teams version would make it possible to
lock down Dropbox to the whole team so that only team members could be added to
a share, but no – you can share with anyone, regardless of whether they’re in
your team or not.
I’d also hoped it would be possible to set
different levels of permission on a share so that I could set up, say, a
management group that is read/write and then have a sales force group that’s
read-only. But no. you can’t create any su8ch groups and you can’t even set
different levels of access for different members. The only options are to “Kick
out” an existing member or to “Make owner”, which transfers your admin role to
that user. That’s the lot. I’ve looked high and low for anything resembling a
grown-up set of team management controls and they simply aren’t there. I’ve
seen waded through Dropbox’s webinars about the Teams version.
Worse still, I can’t enforce a
no-onward-sharing ban across my team. There is, however, a checkbox for “Allow
members to invite others”, which could be catastrophic if I don’t actively
manage each team. I might one day find a bunch of people in there who I hadn’t
authorized but who had been invited by a team member. A team-wide
administrative ban on onward sharing is surely a must-have requirement.
Hopefully,
one day I can use the excellent 1Password to generate encryption keys for
Dropbox
Finally, the “Invite more people” box lets
me type in anyone’s name even someone who isn’t in the team or isn’t on
Dropbox. For example, I just invited one of my own email accounts to view a
folder. I fired up a Windows 7 virtual machine that had no knowledge of me or
Dropbox, went to a browser window and pasted in the URL from the received email
invitation and, bingo, I had a view of the files.
I just can’t understand how Dropbox can be
so naïve about the security of its implementation for business teams. Perhaps
it believes that all its users are going to be sharing is pictures of fluffy
kittens and gurgling babies, but Dropbox for Teams isn’t a
free-with-the-breakfast-cereal product – it costs $722 for five users with 1TB
of space. This isn’t a home-user product, this is software at a serious SoHo
and small-business price point. The lack of businesslike controls, ones thought
through from a proper business user perspective, is more than a little
worrying.
