Millions of people depend on our service every day and we work hard to keep their data safe, secure, and private,' said Dropbox spokeswoman Julie Supan in a statement. 'We believe this complaint is without merit, and raises issues that were addressed in our blog post on April 21, 2011.

'We've focused on helping users avoid the most common threats: not having current backups, not having any backups at all, accidentally deleting or overwriting files, losing USB drives with sensitive information, leaving files on the wrong computer, etc,' said Dropbox in the blog post.ĭropbox responded to Soghoian's FTC letter. The Dropbox response to this is that the service is not intended as a fully-secure file repository, merely as a service that is more secure than conventional ways of carrying around data such as on unencrypted USB sticks. Users can synchronize files between desktop PCs and smartphones, for instance, but no longer open them without loading a dedicated utility which might or might not be available on that device.

One solution - recommended by Dropbox - is for users to encrypt files before uploading them but this comes at a price. In storing those keys, it has the capability to decrypt files.

The core of the Dropbox controversy is that because it encrypts users' files, it necessarily stores the keys used to provide that security. If the file is secure while it is encrypted, but that encryption can be removed at any time, in what sense is the file secure at all?

That's fewer than one in a million accounts,' the company said in a subsequent blog post.įor users such as Soghoian, this renders the use of encryption moot. 'Just so you know, we don't get very many of those requests - about one a month over the past year for our more than 25 million users.

Dropbox cloud security