About &
Archives

PSA: Security of Folder Downloader for Dropbox

I received this inquiry via email:

Could this app leak my Dropbox password? With the recent news that 6.9million Dropbox passwords have been stolen, I am now wondering how secure this app is.

I think it’s better to repost my answer here, with some additional information for semi-technical people.

The app does not know your password at all, because it uses the official Dropbox app or website to delegate authentication. This method generates a token associated with your account that can be used and accessed only by this app.

That said, an hypothetical attacker could steal the application’s secret key to trick Dropbox into thinking the he is using the app, but then he would have to also steal the token issued to each individual user, and that is obviously impossible as the tokens are stored solely on user’s devices, and Android itself prevents other apps from accessing that kind of data. If the phone is rooted, or is connected via USB in debug mode, then the token becomes accessible, but in that case the attacker would have your device in his hands, which becomes your primary problem.

Moreover, the app does not communicate with anything on the internet except Dropbox. Obviously, this a promise on my side – a gentlemen’s agreement, if you like – but any tech person could verify that with a network sniffer.

A few suggestions to keep your data safe:

  • check apps connected to your Dropbox account and revoke those you don’t need (this is done in the Dropbox’s settings)
  • change the Dropbox password often
  • last but not least, enable two-factor authentication, which makes a password leak ineffective by all practical means (unless the attacker has your phone).

Hope this is a sufficient explanation.

Lisa and Me Available for Pre-order

After going through some precious beta reading and a usual round of editing, Lisa and Me is ready for prime time. This wonderful short story will be available on Amazon Kindle for $0.99 on Thursday, October, 9th, but you can pre-order it today.

Lisa and Me

Pre-order on Amazon

At the same time and throughout the subsequent weekend, White Dwarf One will be free on Kindle (that’s called a cross-promotion, if you ask marketing specialists).

Many thanks to the the impavid Chiara, Stefano, and Luigi for their honest feedback, and to Amy Maddox for her wonderful editing feats.

Coming Up: Lisa and Me (Beta Readers Wanted)

A while ago I wrote a sci-fi short story: Lisa ed io. It was in Italian and was just 1,400 words.

It sat there for a few months, collecting dust, despite it had gotten positive comments from – drum rolls, please – a real, published writer!

After a while, I decided to translate it in English to see if and how I could preserve the original style. When I was done, I decided to expand it a little, giving it more context, and I hope more power. Enter Lisa and Me.

Lisa and Me

Now this little gem of mine is in desperate need of two or three beta readers. It is 2,400 words, so it only takes fifteen minutes to read. If you are interested to go through it and give me feedback, get in touch with me via email (my last name dot my first name at gmail dot com). In exchange, I can offer you a similar service: beta-reading and giving you feedback about a work of up to 10,000 words.

On Broken Windows And Social Values

Go and read about the Broken Windows Theory. I’ll wait here, take your time.

Now, I believe there’s one main corollary to that theory:

People don’t do what society tells them is not acceptable.

For example, despite it is very easy to do, people don’t generally kill people. They don’t insult each other. People don’t drop litter on the ground.

Except when they do.

And when is that?

When they perceive that peers won’t consider their actions unacceptable, when social values are bent, relaxed, or absent. Or, most frequently, when they perceive that what they do won’t make any difference, for better or for worse, or that no one will notice.

This is true in software development as well. If your codebase is crap, people will keep pooping onto it. If your organization is messy, people will keep adding confusion just to get to the end of the day with the least effort. “Who cares? Certainly not me.”

Broken Windows

At some point, the local social reality that is your team (in the broader sense) will break down in either of two ways:

  1. Hard reset (throw away bad apples and start from scratch)
  2. Death by bleeding (of good people), which leads to 1.

Now, you probably saw it coming, but neither of them are resolutive unless there’s a fundamental change – after all, the good guys leave, the bad stay. Remember? Until social values change, until you fix your windows, people’s behavior remains the same.

But there’s more.

Inside a business of a non-trivial size, there are several groups, each doing its job and functioning with its own set of social values. You may call it company culture, but I believe it is more team culture, and it’s something that morphs and changes over time, as people come and go. It’s a stereotypical view that the dev group is sort of an enemy to all others. They are these presumptuous kids with their latest crush on the coolest programming framework. These hooligans always doing whatever they want no matter what you tell them and making projects late. Your projects, late because of them (us).

The problem is, they think the same about you and your group.

And, drum roll, this is because of social values. Their group is cohesive because their social values identify marketing, legal, sales, or whichever other group as their enemy. Camaraderie in time of peace (which is a remarkably positive side effect of living as a group in harsh environments).

The circle is now closed: you have just witnessed bad behavior promoted, or at least tolerated, by the means of common, shared, and agreed-upon social values. It’s the same reason why (some) teenagers vandalize public and private property: by showing they belong to the group, they agree to its social values (however wrong), and share, promote, and hand them down to the next member.

How to fix that?

We’re not talking about actual hooligans here, so here are some suggestions based entirely on anecdotal evidence:

  1. Fix broken windows. Rather obvious at this point. The place must be clean and tidy, and it will be less likely to get dirty and messy
  2. Reward good behavior by sharing it with others (positive reinforcement)
  3. Do not punish bad behavior (people are not animals). Explain, and keep in mind that bad behavior might not be perceived as such.

What if that is out of your reach?

You might not be in a position to do any of the above. You might just be the new guy, or you might not have the authority. In that case:

  1. Find those who share your values, and form a new gang that acts upon those values. Give it time, as it will be an uphill battle, but those on the borderline will follow, the others will either leave or be fired (hopefully).

If you have the authority and power to promote change but you can’t, there are probably four scenarios to consider:

  1. You don’t know how (perfectly legit, but that’s your first problem then)
  2. You know how, but there are just too many morons around (or maybe not many, only a few but very influential)
  3. You don’t know how, and there are just too many morons around
  4. You don’t want to change, because you are part of the problem.

Think about it. I know when I am on this scale (but I’m not telling). Where are you?

Playing With Prices

Since the beginning, I set the price of White Dwarf One to $0.99 – the lowest price possible – plus whatever tax Amazon decided to add.

After an initial period of higher figures, the book sold roughly 1 copy per week, if I exclude free promotions and other sources of sales. Horrible results, you may argue, but keep in mind that I am no one, and I spent exactly 0 Euros in marketing.

The perceived value of something is important, and price has an effect on it. Something that costs little might be perceived as of little value. Note the term might. Also, it didn’t make sense that my collection of short stories cost the same as a full-length novel. I would have happily reduced the price of the anthology, but that was not possible.

Following this train of thought, I tried increasing the price of the novel to 2.99$ plus taxes. Well, the new price halved the sales to 1 every 2 weeks (although it increased my royalties).

Now I’ll try with $1.99 and see what happens. My goal is distributing the most copies, regardless of price and earned royalties, and I’m trying to find the right spot, which might not be 99 cents.