I want to know that.

I change my password at dropbox.com. However other computer can still update file.

I wonder how it make sense.

It is possible that one of my ex employee have my password and I want to prevent him from accessing my file.

  • Change the pass and disable the computer's access. Though it wont wipe the computer's drive of already synced data, from my understanding. – nerdwaller Apr 19 '13 at 3:49

I haven't checked the correctness of this article (http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/) but it appears that there had been a period when the Dropbox client don't use your username and/or password to authenticate, but instead it uses a host id which is generated after the first time you enter the username and password to log in. The host id is not changed after that and it will solely be used to identify the user.

Of course, the article also mentioned that the authentication method had been altered and more security enhancement is put. Though I don't see any articles researched on the new authentication method, I suspect that it will still use a similar principle to prevent storing your username and password in the client. So it makes sense that even you changed the password, other clients can still sync the data.

However, it is still perfectly possible to "unlink" clients. The Dropbox website has a help page regarding this:

  1. Sign in to the Dropbox website.
  2. Click your name at the top-right of any page to open the account menu.
  3. Select Settings from the account menu.
  4. Select the Security tab.
  5. In the My devices section, click Unlink next to the computer you want to unlink.
| improve this answer | |

Changing the password is not enough in and of itself to stop access from a device that has already been authenticated. My guess is that they use a token that is stored locally on the device, which is challenged on regular intervals, though what that interval is, I could not comment.

I would recommend both changing the password, and revoking access to any device that may have been compromised. Keep in mind that this will NOT delete the data from that device.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.