Cloud storage isn’t as secure as you think – report

Those wanting to make sure their documents and photos do not fall into the hands of strangers should make sure to encrypt any files saved in cloud services.

Not even the popular online storage service Dropbox is entirely secure, according to the German magazine Computer Bild.

Those searching the site:www.dropbox.com/gallery in Google have access to thousands of private folders, the magazine said. These are the basic standard folders Public and Photos, which actually should only be visible on the web when the users make them public.

Another reason Dropbox should only be used with encryption, according to the experts, is the vulnerability of the accounts. Anyone with a little know-how can save the log-in page of the online service, manipulate it and save it as an html page in their Dropbox.

The link to the manipulated page is then sent to the victim with a subject that sounds interesting. The victim wants to see the pictures and enters their user name and password for their Dropbox account and automatically land at the attacker’s page.

Even experienced users can fall into such phishing traps. Dropbox must block the call-up of html pages saved in Dropbox to eliminate these kinds of attacks.

One freeware programme that can encrypt online storage services such as Dropbox and Google Drive is BoxCryptor. The software creates a virtual drive on the computer. To save a document to the online server, just drag the file from the computer into the desired folder on the virtual drive.

Update: 21 May 2012

A representative of DropBox’s external PR team contacted MyBroadband and said that  photo galleries and public folder files are not available on Google by default.

“Google does not and cannot crawl across all of Dropbox’s public folders,” the representative said. “The user must post the link for a photo gallery or a public folder in a place that Google’s crawler can find them, and only then will they appear in Google’s search results.”

The representative said that the article referenced by this report was removed from the Computer Bild website. However, a version of the original article can still be found on Bild.de.