Security and Permissions
Start a discussion in the Dropbox Community forum to get help with your account security and permissions. Find support from Community members.
I have identified some potential security vulnerability while using Dropbox. I believe this issue may pose a risk to the protection of user data, and I would like to promptly share my findings with you to help enhance the security of Dropbox.
Vulnerability Description:
Dropbox implements a Passcode mechanism to lock the app, but I find the Passcode fails to be invoked when some activities are resumed. Vulnerable Activities are listed as follows.
ID Activity
1 GroupedPhotoPreviewActivity
2 BulkRenameActivity
The detailed instructions for triggering the vulnerability are provided in the attachment.
These vulnerabilities may pose a risk of sensitive data leakage. As you can see from the attachment, some privacy user data, such as personal photos, are clearly displayed on the screen without passcode protection.
I hope this issue can be investigated and addressed as soon as possible to improve the application's security and protect user data. Please contact me for more details or any assistance needed to confirm this vulnerability.
I look forward to your prompt response!
Attachment:
Take GroupedPhotoPreviewActivity as an example:
The middle page is GroupedPhotoPreviewActivity.
when Dropbox goes to the background (❶) and then is awakened, this activity is switched to be running (❷). Unfortunately, the interface lock is not triggered when this activity is resumed.
While navigating to other interfaces activates the interface lock (❸), this particular interface allows direct access to private photos stored within the cloud drive.
Hey @LockDroid, hope you’re doing well.
What I’d suggest is to report this here instead.
If you haven’t already, please have a look at this Help Center article, too.
Nancy
Community Moderator @ Dropbox
dropbox.com/support
Did this post help you? If so, give it a Like below to let us know.
Need help with something else? Ask me a question!
Find Tips & Tricks Discover more ways to use Dropbox here!
Interested in Community Groups? Click here to join!
Hey @LockDroid - thanks for flagging this with us.
I've passed your feedback on to the team - let us know if you have anything else to add.
Cheers!
Walter
Community Moderator @ Dropbox
dropbox.com/support
Did this post help you? If so, give it a Like below to let us know.
Need help with something else? Ask me a question!
Find Tips & Tricks Discover more ways to use Dropbox here!
Interested in Community Groups? Click here to join
Hi, Thanks for your reply! But the bug still exists. Can I know something more? Look forward to your reply!
Hey @LockDroid, hope you’re doing well.
What I’d suggest is to report this here instead.
If you haven’t already, please have a look at this Help Center article, too.
Nancy
Community Moderator @ Dropbox
dropbox.com/support
Did this post help you? If so, give it a Like below to let us know.
Need help with something else? Ask me a question!
Find Tips & Tricks Discover more ways to use Dropbox here!
Interested in Community Groups? Click here to join!
Hi there!
If you need more help you can view your support options (expected response time for a ticket is 24 hours), or contact us on X or Facebook.
For more info on available support options for your Dropbox plan, see this article.
If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!