Hi, I just came across this blog post detailing some, shall we say, unorthodox ways Dropbox is circumventing OS X security features and tricking users into sharing their admin password: http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/ I found the same happened on my system (OS X 10.11.6), Dropbox v9.v.49). Can you explain why you do this?

Tricking users into giving up their admin password is unethical hacking. Dropbox needs to respond and remove this hack.

The thing, Rich, is that there is absolutely no reason for Dropbox not to go through the regular security channels already in OS X. They could just as easily have used Apples APIs to do the same thing instead of doing something that is essentially a "hack". They create their own permission window which gives the illusion that it's OS X asking you, not Dropbox. It's deceitful and extremely weird.

There is no excuse for dropbox to re-add itself, especially after you removed the application. They are hacking users and hurting them.

I've never heard of Project Harmony and don't use integration with MS Office, so I guess that's why I haven't had a problem. I see that Dropbox has created a help article about this. Still, the approach doesn't sit well with me. I can understand that certain elevated permissions are required for some features. Dropbox is the kind of tool that needs to be integrated into the OS to provide all of the capabilities that it does. The way it goes about this is what concerns me. It needs to be clearer about what it needs permissions for. For example, I don't recall seeing any notice that the app would automatically update itself. Every other app I use that has an autoupdate function (including macOS) asks if I want auto updates. There are very good reasons to give the user control over this function (being on a low bandwidth connection, needing to test software changes before using them in production, etc.). Also, if accessibility is only required for MS Office integration, ask if I want to use it rather than installing it and changing accessibility settings. There could be very good reasons why I wouldn't want the integration. Dropbox also should not give itself the ability to make changes to the system that require elevated privileges without prompting. If I remove a feature like accessibility, Dropbox should not add it back without asking permission. What if a hacker figures out how to hack the Dropbox client into letting malware have the same privileges? This may be a very rare scenario, but how do the ease of use benefits outweigh the security needs? If Dropbox needs access that I took away, it can detect it and prompt me to allow it again, warning me what will break and, if appropriate, letting me keep it off permanently.

You better have a really good [removed by moderator] explanation for doing this, Dropbox.. I don't pay you to steal my login password.

Why does Dropbox ask for your computer password

Rich
Super User II
9 years ago
Kim,

Please watch your language on these public forums or your posts could be removed or your account suspended. Your post has been edited. Thank you.
Rich
Super User II
9 years ago
Cross-linking for reference:

https://www.dropboxforum.com/t5/Installs-integrations/MacOS-X-Security-Is-it-normal-to-allow-Dropbox-app-quot-to/m-p/60167

https://www.dropboxforum.com/t5/Dropbox/Security-risk-in-OS-X-Client/idi-p/187402

https://www.dropboxforum.com/t5/Dropbox/How-can-I-disable-the-Dropbox-request-for-my-computer-password/idi-p/161658

This reply will be updated with other posts as they are closed and redirected here.

[Mod update December 11, 2019: updated and removed old links]
Rich
Super User II
9 years ago
I removed Dropbox's accessibility access, but the badges show up just fine. I've not noticed any functionality missing.

The badge appeared, but did you test its full functionality? If not, then it wasn't a valid test of the accessibility requirements.

I'm not arguing for or against either side. I'm only stating that simply seeing the badge show up is not a valid indicator that it's working properly.
Robert S.
Super User alumni
9 years ago
https://techcrunch.com/2016/09/09/dropbox-responds-to-accusations-its-mac-desktop-client-hacks-os-x-security/

https://www.engadget.com/2016/09/10/dropbox-addresses-mac-app-security/

http://www.macrumors.com/2016/09/12/dropbox-responds-to-mac-security-risk-accusations/
Richard P.
Super User alumni
9 years ago
You expect support to hand craft a reply to each of the thousands of *extra* tickets this issue caused to be raised, rather than helping people with actual problems?

Support is there for support, not for Public Relations comments. You wanted a PR reply, not support.
Richard P.
Super User alumni
9 years ago
Once again, the dialog is NOT being faked - that claim has been debunked a lot in the past week or so since the claim was made, its a perfectly normal OSX privilege raising authentication dialog.

The "fake dialog" determination was based on the fact that some of the text is misaligned and its general look and feel, but you can reproduce that with your own OSX authentication dialog by supplying the same text to the call -

https://developer.apple.com/reference/security/1669767-authorization_services_c#//apple_ref/doc/constant_group/Name_Tags

https://developer.apple.com/library/mac/documentation/Security/Reference/authorization_ref/#//apple_ref/c/func/AuthorizationCopyRights

Its a proper OSX dialog, just using an older system C API available on OSX since 10.3 whereas most people have moved over to the newer ObjC and Swift based calls which look different, hence the confusion.
Robert S.
Super User alumni
9 years ago
Jared, repetition of a debunked conspiracy theory doesn't make it any less so.

Kudos though to a certain no-mark blog nobodies ever heard of for the boost to their page views. Shame there's no willingness to correct the misinformation, even when a DB dev takes the time and trouble to personally reach out, but there you go.
Marcin D.
New member | Level 1
9 years ago
Jared as the guys have said it's not being faked. it's an older call, it's that simple. not everybody does things "modern" at times and sometimes it's more efficent to use an older call. specifically if it dont mesh with your current build, because let's say somebody fell behind,so you cant implement all the next features.

I'll never understand why people lose their minds over things such as requiring a password to elevate an install or to set a service level. rather dropbox have it, then some random hacker. least I feel safe with these guys.
Kim V.4
New member | Level 1
9 years ago
Andrew, and I'll ever understand why some people don't lose their minds when companies do things without telling consumers about it. This is a breach of trust, if you don't think so, well, ok. I do, and a lot of people agree with me.

If they were transparent about why they ask for elevated access to the system from the start, then no problem. It's the fact that this "hack" acts like a [removed by moderator] virus that's the problem. If I, the admin, remove it, it should never add itself again without my permission. And no, I don't mean like it does now by popping up the the dialog every time the system is rebooted. It shouldn't ask anymore.

From what's been said, this is to let Dropbox do stuff with Office. Why not ask the user if they want to use these features instead of forcing the feature on the user, especially when it requires that it does something as dubious as this?

Like stated above by others, this is not a good look for a company that proclaims privacy and security as their top mantras for all their users. Dropbox should be scrambling to rebuild trust and fix this, and not go "Well, it's not that bad" which is the feeling I have right now.
Brandon A.2
New member | Level 1
9 years ago
+1