Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My laptop contains my Dropbox folder (under my account). I want to give this laptop to my friend for some time, and he will be using another account. Is it possible that:

  1. He will be able to access this folder?
  2. Virus software (that he might install by accident) will access my Dropbox folder?
  3. Is Dropbox folder encrypted on hard drive?
share|improve this question
24  
> Is it secure to give someone my laptop… The rest of the question is irrelevant; the answer will be no, not likely no matter what follows. –  Synetech Aug 14 '12 at 20:06
6  
> My laptop contains my Dropbox folder... The rest of the question is irrelevant; the answer will be no, not likely no matter what follows. –  Mechanical snail Aug 14 '12 at 22:36
    
The question is impossible to answer as is. Perhaps javapowered uses the Dropbox account to store personal reference copies of the Bible, US Constitution, and other well known historical documents. (1) Your friend can probably read them, but who cares - they are not secret. (2) Your friend could tamper with the reference copy but that would be easily detectable. (3) Your friend could maliciously delete documents but they are easy enough to replace. –  emory Aug 14 '12 at 23:41
1  
Its NEVER secure to give someone your laptop. –  Moab Aug 15 '12 at 2:36

5 Answers 5

up vote 48 down vote accepted

The first rule about computer security:

If I can touch it, I own all data on it.

There are no exceptions to this rule. Physical access = game over. It may take time, but once physical access is obtained, there is nothing you can do to stop a security breach. If you are loaning him the laptop, he certainly has access to every file on that laptop if he wants it.

If you do not wish him to have access to your dropbox or other user files on the machine, remove them from the machine before giving it to him. Ideally, use a file shredder that will overwrite the files on disk.

Ultimately it's up to you to judge the trust in your friend vs. the work required to secure the data against his access, or access he might inadvertently grant to others.

If he needs to install system software, then he will need to have administrator access. If he has administrator access, then he can bypass all OS-level security like file permissions. Only encryption will delay him there, and that's assuming the encryption is properly implemented, and a secure key is used. (Note, I've recovered "average" passwords from the built-in encryption of personal excel 2007 spreadsheets, .rar archives, and windows' EFS. It takes about one day - one week)

If he doesn't have administrator access, he can easily give himself administrator access with the ability to boot the machine from a live CD.

  1. He will be able to access your dropbox folder, as well as every other file on your system.
  2. Any software he installs, including viruses, worms, rootkits, and spyware could have access to every file on your system.
  3. Your dropbox folder is not encrypted on your harddrive, unless you do so manually. You also cannot guarantee that it is encrypted on dropbox's servers (Though I hope that it is, and they say that it is).

Don't forget about temporary files, webbrowser caches, and webbrowser cookies. These can allow him into your web accounts without knowing your password. Please, think of the cookies!


If I were loaning a system to someone I considered a friend for a period of time, I would either swap out the harddrive if I had one hand or could afford a spare, or make a backup of all important information, format the harddrive, and then reinstall the OS. When (s)he returns it, format again and reinstall the OS again. You don't want the viruses (s)he might have picked up, and trying to clean all sensitive information out of a system is extremely difficult.

Not because I necessarily think my friend will abuse the data, but because I don't trust that (s)he won't inadvertently expose the system to someone who does have such desires.

share|improve this answer
2  
I would suggest that "remove" == "secure delete". –  Fran Aug 14 '12 at 19:42
    
@Fran I was already in the process of expanding the answer, but thanks for pointing that out specifically! –  Darth Android Aug 14 '12 at 19:45
1  
Just to be clear, your files should not be considered encrypted on the dropbox servers either. Dropbax can open and look at the files any time that it wants. –  EBGreen Aug 14 '12 at 19:51
3  
@javapowered You want to unlink the computer. The system will be deauthorized to make changes to your account, at which point you can delete the files at your leisure. I think the dropbox uninstaller also unlinks the computer. –  Darth Android Aug 14 '12 at 20:01
1  
@TobiasKienzler If you have the resources to swap harddrives, then by all means, swap harddrives! Such usually boils down to cost, depending on the situation though. :) –  Darth Android Aug 14 '12 at 21:39

No, Dropbox is not encrypted for the contents ON your computer. He can access the folder just fine, and virus software will be able to access it without issue

share|improve this answer

If I considered the person a true friend in the traditional sense, I wouldn't really worry about it. Would you loan this person keys to your house or car?

Anything you really were worried about anyway should be in an high grade encryption volume that requires a key entry on every use since Dropbox isn't really secure anyway.

share|improve this answer
4  
Trust is not a binary thing. The number of people I would happily lend $1 to is much much greater than the number of people I would happily lend $10k to. –  AakashM Aug 15 '12 at 8:09
    
I like this answer. Darth Android,s answer assumes the person that is getting the laptop is incompetent in terms of computer security. That may or may not be true. –  Vorac Aug 31 '12 at 9:09

The dropbox is stored (default) in the users directory so if someone has access to that folder then he can read/write the files (which are unencrypted).

Btw, the same is for google drive and possibly other similar services.

share|improve this answer

It is if you lend the computer (your intention is to let your friend access internet/applications/..., right?) not your data.

So be clever, let him use your computer but not your credentials.

There are many ways to do that but the easiest is to create a guest account (named to your friend so there is no offense - with no administrative rights) with him potentially acredited the right to use Dropbox or such. Five minutes work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.