Hacker News Reader

Comment by mixmax | Hacker News Reader

Try to find a large popular file (a movie or mp3 file downed from the net for instance) and put it in your dropbox folder. Notice that it'll sync almost instantly. When you put a file in your dropbox they calculate a checksum and see if they already have the file somewhere. If they do they just add a pointer instead of having two copies lying around.

Since many large files are saved by a lot of people individually (movies, mp3 files, pdf manuals, etc) this saves them a lot of space. As they get more users this advantage grows.

View on HN

Is this exploitable in some odd way?

What if I wanted to use Dropbox for piracy purposes (I don't, just using an easy to understand model). Could I upload a copy of Avatar.mp4, compute or find the checksum for it, and then distribute just that checksum to other users? Or distribute a file that wasn't Avatar.mp4, but looked like it to the Dropbox client? Would this effectively trick the Dropbox servers into distributing the file for more, so that I could legitimately claim to not be distributing copyrighted material, but just distributing a "magic" file that caused Dropbox to give me a copyrighted file that someone else had uploaded?

If they're using a decent hash algo, manufacturing a collision should be somewhat difficult and I'm really not sure how you could use it as a believable legal defense later.

Or distribute a file that wasn't Avatar.mp4, but looked like it to the Dropbox client?

Modern hashing algorithms make this practically impossible, sorry.

Just because you have a hash string that's not technically a copyrighted film, you could still be guilty of copyright infringement. cf. http://ansuz.sooke.bc.ca/entry/23

Thanks. I was using the film distribution as a simple example, but that wasn't the exact use case I had in mind.

It's smart. We did the same thing with MagicWaiter back in the day. Saved a TON of space!

Are you sure about this? if so is it good practice?

I observed it from my own usage, and I'm hard pressed to see any alternative.

I don't see how it shouldn't be good practice. The only information you're potentially giving away is that someone else that has a dropbox is in possession of the same file as you.

If I were the RIAA or MPAA, this seems to leak enough information to confirm that my copyrighted material is stored on dropbox, which might be enough to get a subpeona issued.

If dropbox client were to still force the upload to happen, and only discard the object afterwards, this "duplicate file exists" information wouldn't be leaked. Presumably, they want to detect duplicates within an account and avoid the transfer in that case in the interest of user experience, but if I've told dropbox to upload avatar, I'm presumably OK with the transfer happening, even if it's not strictly needed because someone else has already uploaded it.

Reply on news.ycombinator.com