The good, bad & ugly of Dropbox authentication error

Businesses need to review cloud permissions and policies in light of online file storage security mishap

Online storage service Dropbox made an embarrassing error Monday, turning off password authentication for millions of users.

The company updated some code on the service just before 2:00 pm Monday, yet the new code included a bug that switched off the need to authenticate to access files on a Dropbox. This means that every file on every Dropbox could have been accessed without requiring any credentials to do so. The company figured out what it had done just before 6:00 pm and quickly closed the hole, but for four hours, users' documents were readily accessible to anyone who was looking.

It's the latest black eye for security in a cloud-based world, following on the likes of Sony's PlayStation Network debacle and other LulzSec shenanigans and high-profile downtime for cloud giants like Amazon.

But, if you'll pardon the pun, they say there's a silver lining to every cloud. So let's start by taking a look at what went right in this instance, and then get into what went wrong.

The Good: Transparency

Dropbox was upfront with this miscue, with CTO Arash Ferdowsi explaining the problem, what caused it, how it was fixed and who was affected in a Monday evening blog post. The company says that "as much as one percent" of its 25 million-plus user accounts were accessed during the security outage.

Since then, it has twice updated that post with the latest information, and says it is sending email to any accounts accessed during the four-hour breakdown with details of activity for user review.

As with any new technology, making sure users trust the cloud is key to its uptake and therefore usage. Amazon took a beating for its silence during its April AWS outage, and justifiably so. By getting out front of this issue, Dropbox minimized the damage to its brand and product and probably made it more likely that users will trust it in the future. So that's good.

The Bad: A Troubling History

However, if Dropbox has a heightened level of sensitivity around security issues, it's probably well deserved. In recent months, the company has been criticized for misleading users about the level of encryption is uses and had an FTC complaint filed against it for the same problem. And for good measure, it's been called out for its stance on handing files over to authorities upon request.

Any one of those problems could be reason enough for a business to stay away from the service. But the fact that all of them--including Monday's little oopsie--occurred over the last 12 weeks should have business owners and IT managers thinking about other options or crafting policies on what can, and more importantly cannot, be stored in a Dropbox account.

The Ugly: Leaving The Door Unlocked

This week's error is particularly onerous. It's not good that encryption isn't up to snuff and it's even worse if Dropbox tried to mislead its users about that. And although it's common policy in cloud services' terms of service, it's disquieting to think that your data can be handed over to the government without your knowing.

But turning off password authentication? That's a whole new level of troubling.

It's sort of like a landlord that promises some level of physical security leaving the doors to your office unlocked overnight.

It's unacceptable that this bug made it into production. Even if only one in 100 Dropbox users' access accounts were accessed during that time, 100 in 100 users' accounts were at risk. And even accepting Dropbox's low estimates, that still means that data from 250,000 users was out there, unprotected.

The Upshot: More Cloud Questions

At a time when small businesses are confused about the cloud and what it has to offer, blatant but avoidable errors do nothing to quell those concerns and fears.

For small businesses, it points out the need to be wary of free or low-cost online services, to do due diligence on any services that you're allowing users to build into their workflows, and to have policies in place that dictate what services can be used and with what types of data.

Dropbox and other tools like it can offer tremendous boosts in productivity, particularly in an era where more users are connecting to work through more devices than ever before. But tools that are meant to be consumer-grade need to be thoroughly examined and the risks understood before any kind of sensitive business data is allowed onto the cloud.

Errors like this are going to happen. That's nearly impossible to avoid as cloud providers scramble to scale and add new features. Businesses need to decide where to draw the line in balancing convenience with security.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags internetsoftwarebackupapplicationsdropboxapplication developmentweb servicesUtilitiesWeb services developmentInternet-based applications and servicesWeb-based Applications

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert Dutt

PC World (US online)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?