Bitcoin Forum
May 10, 2024, 01:17:12 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Caution for those using Dropbox  (Read 3038 times)
Stephen Gornick (OP)
Legendary
*
Offline Offline

Activity: 2506
Merit: 1010


View Profile
April 13, 2011, 06:30:22 AM
 #1

There appears to be a number of people who use Dropbox or other similar service to backup their Bitcoin wallet.

The "Securing your wallet" wiki page ( http://en.bitcoin.it/wiki/Securing_your_wallet ) suggests that you might use a service like Dropbox for storing an encrypted archive that contains your wallet.

However, it appears many are using Dropbox to do a real-time backup of the (unencrypted) wallet.dat file.  

There are risks to doing this.

A few days ago Dropbox was under the spotlight for having security issues.  Coverage by TNW (TheNextWeb) summarized their report with:
Quote
If you are worried about the security of your files generally, it would be advisable to not use Dropbox because files can be transferred to a computer you aren’t necessarily using.

Anyone with access to your unencrypted wallet.dat could grab that file and use it, immediately or at any time in the future to spend your bitcoins.

How might this happen?  
- Does your Dropbox account use the same username (e-mail address) and password that you used with any other site or service?
- Do you have Dropbox installed on any other device using the same account?  Your wallet.dat will "sync" / be copied to each target.
- Are you using anything less than a "strong" password?

Here's a good article on Password Security:
  http://www.infosecisland.com/blogview/12645-Check-Your-Password-Security.html

Recently I learned of an instance where Dropbox was being used specifically to keep a single wallet.dat synchronized between two different installations of the bitcoin client.  The Bitcoin client was not designed to accommodate multiple installations like this, and using Dropbox in this manner will likely bring lost bitcoins or other grief sooner rather than later.  So that this message isn't overlooked, pardon me for "shouting":

*********************************************************************
*                                                                                                                      *
*   PLEASE DO NOT USE DROPBOX TO SYNC YOUR WALLET BETWEEN COMPUTERS    *
*                                                                                                                      *
*********************************************************************

Related:
  - How to set up secure bitcoin savings account in 14 easy steps  
    http://bitcointalk.org/index.php?topic=5194.0

Unichange.me

            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █


Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
Jered Kenna (TradeHill)
Sr. Member
****
Offline Offline

Activity: 420
Merit: 250



View Profile WWW
April 13, 2011, 01:19:52 PM
 #2

It's a really bad idea to store it anywhere unencrypted but this is really good information. Thanks for the post.

moneyandtech.com
@moneyandtech @jeredkenna
Jered Kenna (TradeHill)
Sr. Member
****
Offline Offline

Activity: 420
Merit: 250



View Profile WWW
April 13, 2011, 06:10:59 PM
 #3

The story about Dropbox being unsecure was proven to be a bunch of hoopla.

The idea is that the if someone copies Dropbox's config.db file from your computer they can replace their own config.db for your one and gain access to your files.

Of course, if someone has enough access to get at the config.db file stored on your computer (eg. in C:\Program Files\Dropbox\config.db or ~/.dropbox/config.db) they have enough access to get at your wallet.dat anyway.

I agree but putting it on dropbox unencrypted is not needed and can only increase the chance someone gets it.

moneyandtech.com
@moneyandtech @jeredkenna
Stephen Gornick (OP)
Legendary
*
Offline Offline

Activity: 2506
Merit: 1010


View Profile
April 21, 2011, 05:25:42 AM
 #4

On a related note:
  http://yro.slashdot.org/story/11/04/20/0434205/Dropbox-Cant-See-Your-Datndash-Er-Never-Mind

Unichange.me

            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █
            █


cdnbcguy
Full Member
***
Offline Offline

Activity: 128
Merit: 100


View Profile WWW
April 22, 2011, 01:51:34 PM
 #5

I use Dropbox and I love it, but I never really trusted them for privacy because they ask you to take their word for it that it's all encrypted, whereas we know here that the proper way is to never ask anyone to take your word for anything but to prove it with open source and strong crypto. That's what make Bitcoin work.

I think the way to use Dropbox to handle a wallet.dat file is to have it encrypted with GPG on the disk. That it isn't is an inexplicable design flaw.

Annona ad! Please keep in mind that there is nothing wrong with Bitcoin itself. All it's scandals are caused by wonky websites and sleazy people exploiting it. The light attracts bugs.

When all this bullshit drys up and blows away, Bitcoin will be stronger than ever.
ledskof
Newbie
*
Offline Offline

Activity: 42
Merit: 0


View Profile
April 23, 2011, 09:01:44 AM
 #6

https://spideroak.com/pricing

Just use spideroak.  It does client side encryption, so all the data is encrypted locally before being transmitted to their servers.  Unlike dropbox, who has FULL ACCESS to your data and FULL ACCESS to disclose all your data directly to the government.

Also, you get the same free 2GB, but the prices are lower:

SpiderOak 2GB Free
DropBox 2GB Free

SpiderOak  100GB $10.00/mo
Dropbox 50GB $9.99/mo

Dropbox 100GB $19.99/mo

Spideroak 100GB $100/yr


I like when a company doesn't have to do that 1 cent down marketing $9.99 crap.  I respect them more.

The Spideroak client also lets you have more control over what you sync and some other stuff.  Check it out.
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!