Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I want to know that.

I change my password at dropbox.com. However other computer can still update file.

I wonder how it make sense.

It is possible that one of my ex employee have my password and I want to prevent him from accessing my file.

share|improve this question

migrated from superuser.com Apr 19 '13 at 4:02

This question came from our site for computer enthusiasts and power users.

    
Change the pass and disable the computer's access. Though it wont wipe the computer's drive of already synced data, from my understanding. –  nerdwaller Apr 19 '13 at 3:49

2 Answers 2

Changing the password is not enough in and of itself to stop access from a device that has already been authenticated. My guess is that they use a token that is stored locally on the device, which is challenged on regular intervals, though what that interval is, I could not comment.

I would recommend both changing the password, and revoking access to any device that may have been compromised. Keep in mind that this will NOT delete the data from that device.

share|improve this answer

I haven't checked the correctness of this article (http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/) but it appears that there had been a period when the Dropbox client don't use your username and/or password to authenticate, but instead it uses a host id which is generated after the first time you enter the username and password to log in. The host id is not changed after that and it will solely be used to identify the user.

Of course, the article also mentioned that the authentication method had been altered and more security enhancement is put. Though I don't see any articles researched on the new authentication method, I suspect that it will still use a similar principle to prevent storing your username and password in the client. So it makes sense that even you changed the password, other clients can still sync the data.

However, it is still perfectly possible to "unlink" clients. The Dropbox website has a help page regarding this:

  1. Sign in to the Dropbox website.
  2. Click your name at the top-right of any page to open the account menu.
  3. Select Settings from the account menu.
  4. Select the Security tab.
  5. In the My devices section, click Unlink next to the computer you want to unlink.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.