16

My laptop contains my Dropbox folder (under my account). I want to give this laptop to my friend for some time, and he will be using another account. Is it possible that:

  1. He will be able to access this folder?
  2. Virus software (that he might install by accident) will access my Dropbox folder?
  3. Is Dropbox folder encrypted on hard drive?
Improve this question
4
  • 24
    > Is it secure to give someone my laptop… The rest of the question is irrelevant; the answer will be no, not likely no matter what follows.
    – Synetech
    Commented Aug 14, 2012 at 20:06
  • 6
    > My laptop contains my Dropbox folder... The rest of the question is irrelevant; the answer will be no, not likely no matter what follows.
    – Mechanical snail
    Commented Aug 14, 2012 at 22:36
  • The question is impossible to answer as is. Perhaps javapowered uses the Dropbox account to store personal reference copies of the Bible, US Constitution, and other well known historical documents. (1) Your friend can probably read them, but who cares - they are not secret. (2) Your friend could tamper with the reference copy but that would be easily detectable. (3) Your friend could maliciously delete documents but they are easy enough to replace.
    – emory
    Commented Aug 14, 2012 at 23:41
  • 1
    Its NEVER secure to give someone your laptop.
    – Moab
    Commented Aug 15, 2012 at 2:36

5 Answers 5

Reset to default
48

The first rule about computer security:

If I can touch it, I own all data on it.

There are no exceptions to this rule. Physical access = game over. It may take time, but once physical access is obtained, there is nothing you can do to stop a security breach. If you are loaning him the laptop, he certainly has access to every file on that laptop if he wants it.

If you do not wish him to have access to your dropbox or other user files on the machine, remove them from the machine before giving it to him. Ideally, use a file shredder that will overwrite the files on disk.

Ultimately it's up to you to judge the trust in your friend vs. the work required to secure the data against his access, or access he might inadvertently grant to others.

If he needs to install system software, then he will need to have administrator access. If he has administrator access, then he can bypass all OS-level security like file permissions. Only encryption will delay him there, and that's assuming the encryption is properly implemented, and a secure key is used. (Note, I've recovered "average" passwords from the built-in encryption of personal excel 2007 spreadsheets, .rar archives, and windows' EFS. It takes about one day - one week)

If he doesn't have administrator access, he can easily give himself administrator access with the ability to boot the machine from a live CD.

  1. He will be able to access your dropbox folder, as well as every other file on your system.
  2. Any software he installs, including viruses, worms, rootkits, and spyware could have access to every file on your system.
  3. Your dropbox folder is not encrypted on your harddrive, unless you do so manually. You also cannot guarantee that it is encrypted on dropbox's servers (Though I hope that it is, and they say that it is).

Don't forget about temporary files, webbrowser caches, and webbrowser cookies. These can allow him into your web accounts without knowing your password. Please, think of the cookies!

If I were loaning a system to someone I considered a friend for a period of time, I would either swap out the harddrive if I had one hand or could afford a spare, or make a backup of all important information, format the harddrive, and then reinstall the OS. When (s)he returns it, format again and reinstall the OS again. You don't want the viruses (s)he might have picked up, and trying to clean all sensitive information out of a system is extremely difficult.

Not because I necessarily think my friend will abuse the data, but because I don't trust that (s)he won't inadvertently expose the system to someone who does have such desires.

Improve this answer
9
  • 2
    I would suggest that "remove" == "secure delete".
    – Fran
    Commented Aug 14, 2012 at 19:42
  • 2
    Just to be clear, your files should not be considered encrypted on the dropbox servers either. Dropbax can open and look at the files any time that it wants.
    – EBGreen
    Commented Aug 14, 2012 at 19:51
  • 1
    how can I temporaly delete all dropbox files on local computer without deleting them on server?
    – Oleg Vazhnev
    Commented Aug 14, 2012 at 19:59
  • 4
    @javapowered You want to unlink the computer. The system will be deauthorized to make changes to your account, at which point you can delete the files at your leisure. I think the dropbox uninstaller also unlinks the computer.
    – Darth Android
    Commented Aug 14, 2012 at 20:01
  • 1
    @TobiasKienzler If you have the resources to swap harddrives, then by all means, swap harddrives! Such usually boils down to cost, depending on the situation though. :)
    – Darth Android
    Commented Aug 14, 2012 at 21:39
7

If I considered the person a true friend in the traditional sense, I wouldn't really worry about it. Would you loan this person keys to your house or car?

Anything you really were worried about anyway should be in an high grade encryption volume that requires a key entry on every use since Dropbox isn't really secure anyway.

Improve this answer
2
  • 5
    Trust is not a binary thing. The number of people I would happily lend $1 to is much much greater than the number of people I would happily lend $10k to.
    – AakashM
    Commented Aug 15, 2012 at 8:09
  • I like this answer. Darth Android,s answer assumes the person that is getting the laptop is incompetent in terms of computer security. That may or may not be true.
    – Vorac
    Commented Aug 31, 2012 at 9:09
2

No, Dropbox is not encrypted for the contents ON your computer. He can access the folder just fine, and virus software will be able to access it without issue

Improve this answer
2

The dropbox is stored (default) in the users directory so if someone has access to that folder then he can read/write the files (which are unencrypted).

Btw, the same is for google drive and possibly other similar services.

Improve this answer
0

It is if you lend the computer (your intention is to let your friend access internet/applications/..., right?) not your data.

So be clever, let him use your computer but not your credentials.

There are many ways to do that but the easiest is to create a guest account (named to your friend so there is no offense - with no administrative rights) with him potentially acredited the right to use Dropbox or such. Five minutes work.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .