0

I am a Dropbox user. Today when I hit the PrintScreen button on windows 7, a popup opened saying something like:

Save your screenshots directly to the Dropbox?

Is Dropbox really logging my keys? If so, is that a legitimate action?

Improve this question
4
  • 2
    Just because notepad types what you press on keyboard does not mean it "logs" keystrokes. Similarly...
    – tumchaaditya
    Jan 19, 2014 at 19:40
  • Not that it changes much, it could be useful to know what platform we are talking about, in order to better put answers into context. Computer/tablet/smartphone? Operating system?
    – abstrask
    Jan 19, 2014 at 19:50
  • Probably a windows desktop or laptop.
    – NReilingh
    Jan 19, 2014 at 19:58
  • @tumchaaditya notepad only writes when it is active
    – Muhammad Yasir
    Jan 20, 2014 at 3:28

5 Answers 5

Reset to default
6

Basically, regardless of platform, it's all about trust.

You're right about being suspicious - everyone should. All programs you install, on your computer or on your smartphone, has the potential to screw you over to some degree. A lot of people don't think twice (or even once), before installing "OMG OMG Awesome Wallpaper" app on their phone, which requires access to sending text messages, calling phone numbers etc.

On the smartphone/tablet landscape, you get some degree of security, as long as you only install apps from established app shops (Apple's App Store, Google's Play etc.). You still need to be cautious when installing apps and apply your common sense, when an app prompts for permissions, that really shouldn't be necessary to complete it's stated function.

In this specific case, I'd consider Dropbox to be fairly trustworthy and I have no reason to suspect they're logging your keystrokes. If you don't want to take advantage of the screenshot function, don't enable it. But I don't see the need to go as far as to remove Dropbox, if you otherwise find it useful.

My point is, that pretty much any app can get personal data from your device, and send it back to the mothership - regardless of platform. Typically, rogue applications don't prompt you before doing so though ;-).

Improve this answer
1
  • 1
    w.r.t to app requirements for smartphones, its often exaggerated..i mean if dev uses some API remotely related to a function, it simply lists that app uses that function(like sending text messages). And as long as one installs apps from designated app store, they can be quite safe from intended malicious use of their identity.
    – tumchaaditya
    Jan 20, 2014 at 3:55
3

You are making a large assumption that Dropbox is looking specifically for a keypress of the "Print Screen" key. It is much more likely that Dropbox is able to tie in to an API that tells it when you have taken a screen shot.

Even if they are looking for a key press, as a programmer you don't do this by observing every input from the keyboard, and especially not by logging every input from the keyboard. Essentially, as Dropbox, you tell Windows to let you know whenever the user does hit the print screen key.

At the end of the day, though, whenever you install a program that is able to affect your system, you need to be sure you trust the app and its developers. In my opinion, it would be pretty silly to mistrust Dropbox over a bit of inter-process event communication that you don't fully understand, since they are a very large operation that has a reputation to maintain, and there are security and malware analysts that keep them under heavy scrutiny. If one of these analysts did find something nefarious, it would be huge news. For me, that's enough to trust Dropbox do be doing what it says it is with my data.

Improve this answer
1
  • 1
    The difference is registering a global hotkey and a keyboard hook. But you can't easily tell the difference, apart from best practice - which doesn't have to be followed. And I would consider it a better quality to mistrust when you don't understand (and then try to learn) than the opposite.
    – Bob
    Jan 19, 2014 at 21:57
2

You can disable that feature in Dropbox preferences / Import, then uncheck the box next to "Share screenshots using Dropbox."

Other than trusting this setting, you would really need to go into the very details of analyzing Dropbox. This task would include disassembling Dropbox, monitoring all the data it sends to the Internet etc. That's better be done by someone how knows how to do that, e.g. a malware analyst.

Improve this answer
1

All programs have the ability to watch for certain keys and do something with them.

They're not sending the information anywhere, it's just waiting to see if you press it so it can pop that box open.

Improve this answer
5
  • 1
    is there any way to view this?
    – Muhammad Yasir
    Jan 19, 2014 at 19:07
  • View the fact that they don't keylog you?
    – Jon
    Jan 19, 2014 at 19:08
  • which programs are watching my key stokes?
    – Muhammad Yasir
    Jan 19, 2014 at 19:10
  • "They are not sending the information anywhere" is just a guess. How can you be sure about that?
    – Thomas Weller
    Jan 19, 2014 at 19:20
  • 1
    If you really want to be sure, you could fire up wireshark and try to weed through the network traffic to the Dropbox servers, or try to reverse the program. Generally, though, for closed source programs it's a matter of trust / good faith.
    – Joost
    Jan 19, 2014 at 19:57
1

If its an executable program you installed (or app on a phone), and its running, it can see all sorts of stuff, like what else your running, what your typing (e.g. looking out for a printscreen), etc. So the short answer is not to let any software on your system you do not trust.

Assuming you trust your web-browser (is there really much choice these days), web-applications that do not use a plugin/extension are far more restricted and cant generally monitor the user, or download/install other unknown software.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .