You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
Desktop/mobile client syncing after password change: security flaw?
Last week I've change my password though the website, at work. On my home computer I have installed the Desktop client. I have not changed a thing and it was syncing without problems.
The same hap...
techs2017 if somebody has your password then installing Dropbox is the least of your worries.
Super Users are not employees but the answer is the official one - this isnt a security flaw. Its by design.
When somebody adds Dropbox to their computer you receive an email telling you this has happened, unless you've disabled those security emails in the Account section.
Also, if they did do that then you can unlink the account via the same Account page. For Plus and Business users you can also request that a remote delete is done while unlinking clients.
If I change my google password, all devices connected to my google account will not allow me to access my gmail unless I enter the new password. I have two laptops (one windows and one macos) connected to dropbox (using client dropbox). Today, I chabnged my password going to the dropbox website. But my windows laptop (which has the old password)( is syning as usual as if nothing happened. This got to be a bad security flaw.
Even Microsoft has abandoned the obsolete security practice of changing passwords frequently and it's no longer part of their security baseline. It's been in the news for some time.
In this case, Dropbox handles this poorly. Everywhere else, changing a password in one place requires updating it everywhere else. It is far too easy to miss a place, and checking some random list (this is the first I've heard of it, and I've been using Dropbox for years) that isn't prominently displayed and part of the onboarding tutorial is both a UI mistake as well as a policy mistake. Companies should always act in the best security interests of customers, and allowing a token to continue operating is a direct contradiction.
Please revisit this decision.
Thank you.
- Jane
Dropbox Staff
