Is there any verification that the encryption used can not be bypassed by the operator or should I actually use some encryption of my own like TrueCrypt?

edit In the light of this complaint against Dropbox by Christopher Soghoian, should the answers given to my question be revised?

edit2 it's getting better and better...

Bottom line: everything you never ever want to be made public should be encrypted by yourself.

4 Answers 4


If your files are of a very sensitive nature then you should already be taking measures to secure them regardless of any promises or the good reputation of the service.

If however these files are of 'normal' sensitivity then the risk of bad press will usually be enough to guarantee they're good behaviour, after all your files are probably worth less to them than your (even potential) subscription fees.


There is no way you can tell if the companies can get access to your files, and given that they could probably bypass your password for login - it's likely that they could get to your files if they really wanted to.

The only way to be 100% sure that you alone have access to your files is to encrypt them or host the service yourself. In the latter case, you should be aware that any large company is probably going to be able to do backup and security better than you.

Finally - A company like dropbox has better things to do than to go through your files. I would suggest that for larger / more well known companies, your files will probably be safe. Firstly because their businesses rely on you trusting them and secondly, because you're just one account in a myriad of accounts.

  • 1
    Of course everyone should have better things to do than going through my files, but assume I store my Keepass file here which may include logins which could be misused for purchases etc. Commented Jul 8, 2010 at 9:19
  • 2
    @Tobias Your Keepass file is already encrypted (assuming you set a master password to open it).
    – dbkk
    Commented Jul 8, 2010 at 10:49
  • @dbkk right you are... consider sensitive data like an unpublished thesis then Commented Jul 8, 2010 at 11:39
  • 2
    @Tobias: I wouldn't really consider an unpublished thesis "sensitive data" - unless you are proving P==NP or something like that, there are relatively few people in the world who would find your thesis useful enough to steal it, and most likely none of them both work at Dropbox and are unethical enough to use their position to peek at your files. I would feel fine putting thesis work on Dropbox. Still, if you're concerned, it shouldn't be too hard to encrypt the files.
    – David Z
    Commented Jul 9, 2010 at 3:30

If you feel you can't trust them, you might be interested in TarSnap - "Online backups for the truly paranoid", developed by Colin Percival.

  • 1
    I'm not paranoid; these people really are after me! :) But I agree. Encrypt your really sensitive files before uploading to a shared online service.
    – William
    Commented Jul 9, 2010 at 12:33

Not sure about Dropbox. But from the Wuala service I am using, this is what they claim:

Wuala protects your privacy: In stark contrast to most other online storage services, all your files get encrypted on your computer, so that no one - including the employees at Wuala and LaCie - can access your private files. Your password never leaves your computer.

Wuala employs the 128 bit AES, 2048 bit RSA and SHA-256 algorithms for encryption, signatures and integrity checks. If you're interested in how Wuala manages encryption, have a look at our publication on Cryptree.

Convincing enough for me.

  • 2
    It is easy to state that, but unless the source is available and has been audited, I don't know... Commented Jul 8, 2010 at 9:16
  • 1
    daemonology.net/blog/2008-11-07-wuala-security.html says: "Make sure that your password is strong; that you don't reuse it anywhere; and that you never type it into an untrusted system or where people could watch you or listen to your typing. Realize that you can't trust the authenticity of any public files. Don't modify and re-upload files if you don't want people to know what files you've changed. And recognize that ultimately you're completely trusting Dominik Grolimund and the Wuala staff with your computer and your data. But aside from that, Wuala's security now looks fine."
    – Tader
    Commented Jan 7, 2011 at 21:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.