1y ago

Dropbox removed ability to opt your files out of AI training

news.ycombinator.com /item

Dropbox removed ability to opt your files out of AI training::undefined

96 comments

Why does dropbox have the ability to see your files at all? That seems like a pretty bad security flaw in the first place.
- Because you gave them the files?
  If you don't want dropbox to see them, encrypt them.
  
  deleted
  
  The downside is I used to use Dropbox a lot for collabs with others. We're now using something else (Google Drive 🤮) but for a while, Dropbox was king.
- Man wait til you hear about Gmail
  
  Email is like the one critical part a lot of people miss when talking about taking control of your data. Imagine how much could be gleaned out of email history? Where you go, what you do, who you talk with, what you buy, what you rent, what media you consume, everything. If you dont have a lot of friends someone with your email account could pretty much just doppelganger you and go on as if nothings happened.
- There are drawbacks to end-to-end encryption (E2EE). I'm not aware of any E2EE cloud storage systems that have the features Dropbox provides. I would LOVE to know of any that...
  Support at least the big 5 platforms (Android/iOS/Mac/Windows/Linux).
  Have a functional web interface.
  Support sharing and collaboration.
  Have a search feature
  Sync to the local filesystem on a folder-by-folder or even file-by-file basis
  Integrate with other tools (e.g. android file picker)
  It's not easy to do all that with E2EE, like a functional web interface, search, and integration.
  ProtonMail's search, for example, is limited to subject and metadata, and that's specifically because they DON'T use E2EE for that.
  I'm willing to compromise some of this for the sake of E2EE, but I'm not at all surprised that feature-first services are more popular than privacy-first services.
  
  I think proton drive covers all but the collaboration
  
  You will probably have tradeoffs. And somehow need to script accept that at some point, you need to trust someone. At the very least with firmware. And you probably need to change workflow.
  I find cryptpadb works almost as well as Google docs did a few years ago.
  
  1: easy to port E2EE, it's just math
  2: browsers and E2EE is hard, you need an extension to implement it securely so the password can't be made accessible directly to the server (you need it to remain secret even from the hosting company) or else you're dealing with MITM risk
  3: easy by sharing encryption keys using E2EE messaging protocols on top
  4: encrypted search is a thing, but such indexes does tend to have some limitations
  5: still easy
  6: still easy, Android specifically have APIs to let apps register themselves to the file picker so they can transparently encrypt and decrypt files. But yes on other systems where 3rd party apps can't offer such integration then it's hard
  I've seen one called Skiff that's trying to do most of these things
  https://skiff.com/pages https://skiff.com/drive
  
  Mega uses e2ee and is available in all platforms I use. I don't use apple. Web interface is very functional. I think it does support sharing files via link. Should have a search feature also, never used (because I know exactly where I keep my files). It does sync with locals. I don't know about android file picker.
  Mega is not a good choice for Lemmy users or Foss activists, probably because of its history - which is not as clean as say next cloud, but is not like google either. As long as it works :/

Response from dropbox in that post: "Jumping in to clarify some confusion. The AI third-party toggle is only visible to users who have access to our AI features. If you don’t see the AI third-party toggle, then you can’t view or use Dropbox AI features. To reiterate, neither this nor any other setting automatically or passively sends any Dropbox customer data to a third-party AI service. Please see our Help Center article for a list of those with access to Dropbox AI features."
- I don't know why I find it so surprising that Dropbox apparently has a Hacker News account, but I am mindblown that's a thing.
  I thought HN would be way too niche for that to be a thing.
  
  Seeing dropbox is actually a ycombinator alumni it’s not that surprising 😄
  
  Dropbox is pretty cool. (Don't mistake this as some weird astroturfing.) I remember hearing about their custom hardware on an episode of se-radio. Very fascinating stuff.

You can still opt out by opting not to use Dropbox.
- This is the sensible option. Fuck them.
  
  Just encry client side before upload

Guess I need to find and close that account now
- I did this. Enjoy unsharing literally every shared file and folder and removing access etc. I thought I deleted all my files. Nope. Checked the shared area. You’ll need to undo all of that manually. Only then was I finally able to rid myself of this enshittified disaster. Goodbye forever Dropbox. The only good you ever did was scannable.

I HATE Dropbox.
I tried to use them recently and their service had some problems.
They have an option to "stream" files when you need them. The only problem is you need an internet connection to access them. I did not trust this kind of system and I actually need to access my files even without internet.
So there is a way to make the files available offline. Great! Problem solves. NOPE! They offer an option to have your files available offline, but they might remove the files and make them only available in the cloud if you local storage gets low.
That is really all they say about it and there is no option to turn this off. I was uncomfortable about their vagueness and my inability to disable this.
Within 24 hours of paying for their service I learned of this and they refused to refund my purchase.
PLEASE NEVER WORK WITH DROPBOX
- I've had a great experience with Dropbox (for about 10 years!), but I also used their Linux client which is old and very straightforward. Now I'm a Nextcloud user, and I wish it worked as well as Dropbox did. But with this AI thing I'm not switching back.
- I've used Dropbox since literally their first year of creation and I've never experienced a single one of these issues. I use it mostly as a portable library and all I need is 2 mins of any internet connection to download any book(s) I want to read to a local device. Mind you this is on their free plan, so I've never paid a cent to them either. Requires me to periodically transfer older books to another long term solution, but that is just a few mouse clicks. I've read hundreds if not more ebooks this way. Since I prefer .mobi (which I can even read IN dropbox if I want) I can upload straight to dropbox after converting from .epub.
  I mean, it sounds frustrating, but your experience with them sounds extremely weird to me.
  At least to me they've been the best cloud provider by far, for what it's worth.
  With that said, I don't especially like that they're doing this even though my specific content is mostly available in any number of places anyway, given that it's literature.
- it was painful to migrate from dropbox. their api is shit and does nothing to guarantee delivery. i had to split folders into 5gb chunks and download everything in zip files through the browser. it took a year. what an awful company.
  
  Why not use something like rclone to download your stuff?
  
  I’ll never work with them again and actively. Advocate against them.
- Instructions unclear
  Uploading various types of Nightshade to DropBox.
  EDIT: I see a couple downvotes so I thought I would explain: Nightshade was developed as a way to poison or corrupt AI Generative Tools. Basically by uploading Nightshade I'm harming their results.

Closing my Dropbox account now.
- Wnat are you going to?

Wait, Dropbox can use your files to train AI? How is this acceptable? Aren't people storing their keepass vaults there?
- Those had better be encrypted
- Password manager is one of the few "free" services that I pay for. Still feeling pretty good about 1password.
  
  Pff, such capitalist bull. But communists at least have LastPass, that shares our passwords with the world under the banner of no private ownership.
  But seriously, paying for a password manager is a good thing. Find a good and secure one that is properly vetted and trusted in the industry, and support them if you can.

I said this in another post:
If your business is using Dropbox as cloud storage, you are so fucked!
In 2015, I worked in a company that stored financial records. Small restaurant company with 80 employees. I emailed them last week about this and they're already making moves to leave.
- It's wild that you're still in contact with your former employers.
  Literally every single one has "fired me" and escorted me from the premises after I put in a 2 week notice.
  
  You can leave a company on good terms.
  I also highly recommend not burning bridges. Even if they were a shit storm, 2-3 years later you might change your mind.
  
  Maybe he has good friends in the Exec leadership.

Literally the first sentence of your own source:
Dropbox has hidden third party AI settings, not disabled them
- But the comments below say they're not able to access the new page, even with the direct URL... It seems certain tiers of customers can't opt out. Possibly they can't be included in the first place (e.g. EU users), but it's a pretty big screw up to hide one's status on such an important privacy setting.
- Ok, so how do I as a user access these to change those settings please?
  
  If they're hiding them, chances are it's only going to get worse, not better.

Time for dropbox users to upload all kinds of crap for ai to "learn" from, all within tos of course.
I bet there are many kinds of ways to make your files poison the ai learning data. Its going to be fun for those ai guys to sort which files are probably safe and which are not. I think even if ONE user manages to slip something that corrupts the training data and its not noticed soon enough it might cause problems for them. Though someone who actually knows something about the subject might want to tell if i'm talking shit or not.
I'm not against ai in general, but if its trained with data that was obtained from unwilling people, like this, then its makers can fuck off.
- It really depends on what the AI training is looking for. You can potentially poison an AI training model, but you'll likely have to add enough data to be statistically relevant.
  
  enough data as in many different people will have to upload one or two files that contain such data or you have to upload very large file that contains a lot of data that causes problems?

Best time for people to learn about home servers.
- The problem, as I'm sure you know, is that a home server is not fit for purpose for the vast majority of people. Managing that is a fun project for some, but a complete non starter for most.
  
  Synology makes it relatively painless with synology drive. It ain't cheap but neither is drop box long-term
- Cost prohibitive for many, but yes, people need to get off someone else's computer.
  
  You can easily repurpose old drives for this. I started my server scavenging drives and using my laptop. I upgraded to some WD NAS HDD and I'm about to upgrade to a better Synology NAS.
  There are options for people wanting to start hosting.

Thanks I forgot I even had a dropbox account. And everything is deleted files and account.
- Check for old shares. I had EVERYTHING deleted, from files, recycled bin...For nearly a decade already. BUT. Today I just found there were old shares of those deleted files. I clicked to delete the shares too. Guess what, the files were back onto the dropbox folder as if they never were deleted a decade ago! So I had to delete them again, and then from the recycle bin. And then deleted the account.

If someone has a way to poison their AI training by adding junk along my regular files I'm interested. Sadly I use it at work and I cannot decide to migrate to another cloud so I better sabotage them
- There's probably lots of ways, look up adversarial samples in machine learning and poisoning attacks
  https://christophm.github.io/interpretable-ml-book/adversarial.html
  https://www.computer.org/csdl/magazine/co/2022/11/09928202/1HJuFNlUxQQ
  
  Thank you for your contribution, I was referring to a practical way (script, binary, ...) to achieve this not academic literature, I don't have much time to invest in this and my IT level is insufficient
- Create a lot of text files filled with offensive and false information. Maybe 4chan and OANN transcripts :)
  It will always be a cat-and-mouse game. Once the trainers recognize the attack, they can use the attack to further improve their models. A long time ago I watched a speech from a guy who worked on Yahoo! Mail's spam detection. They realized spammers would create email accounts, send spam to them, then have the accounts mark their spam as "not spam." They came up with a method to automatically identify these accounts, and used them to further improve their spam detection model (if these accounts marked something as "not spam" it was likely spam).

Happy I moved to Syncthing a long time ago. My data is replicated on several locations and instances on cheap old raspberries+drives and syncs instantly even on my phone, where I keep Obsidian notes. No size limits, no huge hassle, 10 minutes to get a new instance set up.
Every now and then I will rsync the encrypted version to an offline drive and store it somewhere else.
- What do you use for encryption? I'm open to options for encryption. Any opinions about Veracrypt?
  
  Syncthing has built-in encryption and works pretty well, it's also really easy to use. I have been using it for some time with several instances and never had a problem, it requires more CPU though, so some old raspies had a hard time working with my big photos folder (800GB) when encrypted. On instances that are not encrypted, the full HDD is encrypted (the option you have when installing Linux).
  Not sure how secure it is, but from the docs: Encryption is XChaCha20-Poly1305 and AES-SIV with a key derived from the password and folder ID using scrypt. Considering how polished, huge user base and how much attention to detail Syncthing has, I trust it's good enough for my needs.

So are there any files that an AI shouldn't vacuum up that I just happen to have in my dropbox?
- Anything private or financial

Apparently Proton has a drive service now...

If you aren't aware rclone makes it easy to backup (copy) or sync files to different cloud providers like Dropbox and you can setup encryption very easily so you can continue using Dropbox since it does have pretty good value for the price even though they've shown they aren't trustworthy.
https://rclone.org/dropbox/ https://rclone.org/crypt/ https://rclone.org/commands/rclone_copy/ https://rclone.org/commands/rclone_sync/
- For android there is RoundSync. It automatically backs up folders of your choice on a schedule. Not on any app store. It must be installed by downloading the apk from GitHub.
  There is also Cryptomator as an alternative. I used it for years without issue, but prefer rclone for more control over my work stream. Think I paid a one time license of $10 for desktop and another $10 for mobile.
  Dropbox is only a good deal if you use near peak storage and/or do a lot of data transfers.
  I was paying $120/yr for 2TB. Now I'm on B2 Backblaze. On paper Dropbox was cheaper per GB, but with my usage pattern I'm paying like $1.00 every other month.
  
  I looked into backblaze and was kind of turned off by the egress fee though I doubt I would exceed that for backups unless I had some really bad luck. Dropbox integrates with a lot of apps and that provides some value to me and with the comparable pricing Dropbox seems safer.
  That said I'd love to hear more because I think my situation sounds similar to yours. "$6/TB/Month. No Hidden Fees. No Delete Penalties" but then it says "Storage: $0.006 GB/Month Download: Free up to 3x monthly storage" and I'm confused, is it $6 a month for a TB or is it $0.62 for 1024 GB at $0.0006 GB/Month?

I have my dick pics in there wtf is AI going to learn
- What hotdogs look like, obviously
- The latest stable diffusion base model will be trained 100% on Dropbox dick pics. Your dick's likeness will be merged with that of thousands of other dicks and will be used to generate semi-realistic dick imagery.

So if I don’t opt out can I force the AI to train on my files?

Wow! Never used Dropbox but wonder if google drive is doing the same ? 🤔

opt your files out
your files?
your files? LOL
Don't forget, Dropbox belongs to Microsoft. The harddisks where "your" files are stored belong to Microsoft.
- Unless you have a source this is straight up disinformation. As far as I'm aware and as far as I can tell, Dropbox is an independent company.
- Source? I never heard about a MS acquisition or majority stock buy.
- you might be confusing one drive with Dropbox, I don't think DB is MS owned

96 comments