Online storage service Dropbox made an embarrassing error Monday, turning off password authentication for millions of users.
The company updated some code on the service just before 2:00 pm Monday, yet the new code included a bug that switched off the need to authenticate to access files on a Dropbox. This means that every file on every Dropbox could have been accessed without requiring any credentials to do so. The company figured out what it had done just before 6:00 pm and quickly closed the hole, but for four hours, users’ documents were readily accessible to anyone who was looking.
It’s the latest black eye for security in a cloud-based world, following on the likes of Sony’s PlayStation Network debacle and other LulzSec shenanigans and high-profile downtime for cloud giants like Amazon.
The Good: Transparency
Dropbox was upfront with this miscue, with CTO Arash Ferdowsi explaining the problem, what caused it, how it was fixed and who was affected in a Monday evening blog post. The company says that “as much as one percent” of its 25 million-plus user accounts were accessed during the security outage.
Since then, it has twice updated that post with the latest information, and says it is sending email to any accounts accessed during the four-hour breakdown with details of activity for user review.
As with any new technology, making sure users trust the cloud is key to its uptake and therefore usage. Amazon took a beating for its silence during its April AWS outage, and justifiably so. By getting out front of this issue, Dropbox minimized the damage to its brand and product and probably made it more likely that users will trust it in the future. So that’s good.
The Bad: A Troubling History
However, if Dropbox has a heightened level of sensitivity around security issues, it’s probably well deserved. In recent months, the company has been criticized for misleading users about the level of encryption is uses and had an FTC complaint filed against it for the same problem. And for good measure, it’s been called out for its stance on handing files over to authorities upon request.
Any one of those problems could be reason enough for a business to stay away from the service. But the fact that all of them–including Monday’s little oopsie–occurred over the last 12 weeks should have business owners and IT managers thinking about other options or crafting policies on what can, and more importantly cannot, be stored in a Dropbox account.
The Ugly: Leaving The Door Unlocked
This week’s error is particularly onerous. It’s not good that encryption isn’t up to snuff and it’s even worse if Dropbox tried to mislead its users about that. And although it’s common policy in cloud services’ terms of service, it’s disquieting to think that your data can be handed over to the government without your knowing.
It’s sort of like a landlord that promises some level of physical security leaving the doors to your office unlocked overnight.
It’s unacceptable that this bug made it into production. Even if only one in 100 Dropbox users’ access accounts were accessed during that time, 100 in 100 users’ accounts were at risk. And even accepting Dropbox’s low estimates, that still means that data from 250,000 users was out there, unprotected.
The Upshot: More Cloud Questions
At a time when small businesses are confused about the cloud and what it has to offer, blatant but avoidable errors do nothing to quell those concerns and fears.
For small businesses, it points out the need to be wary of free or low-cost online services, to do due diligence on any services that you’re allowing users to build into their workflows, and to have policies in place that dictate what services can be used and with what types of data.
Dropbox and other tools like it can offer tremendous boosts in productivity, particularly in an era where more users are connecting to work through more devices than ever before. But tools that are meant to be consumer-grade need to be thoroughly examined and the risks understood before any kind of sensitive business data is allowed onto the cloud.
Errors like this are going to happen. That’s nearly impossible to avoid as cloud providers scramble to scale and add new features. Businesses need to decide where to draw the line in balancing convenience with security.