nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

I changed my password, but some users can still access my Dropbox account

Gavin H.4

Hi - I have a Dropbox account which I share with a few people. In effect a single Dropbox login and a few people know the password. Some of these access it via the Dropbox App. I have changed the password on the main Dropbox account, thinking this will stop them accessing it, but a number still seem to have access to it? Bit concerned as I though once the password was changed they would lose their access.

Find more posts tagged with

Security

Account Access

Passwords

Disagree

Accepted answers

Mark

Bit concerned as I though once the password was changed they would lose their access.

No, you need to actively unlink those peoples Dropboxs from www.dropbox.com/account

All comments

Mark

Bit concerned as I though once the password was changed they would lose their access.

No, you need to actively unlink those peoples Dropboxs from www.dropbox.com/account

Gavin H.4

Thank you for your help. That's really poor security though isn't it? Normally if you give someone access to your account by sharing the password, if you then change it they should not be able to get back into the account? Come on Dropbox that's a massive security hole?

Mark

Normally you wouldn't give somebody access to your account though - its basic security. Would you give them access to your email? No. By giving them your password they could do ANYTHING at all to your account and you'd have no come back at all - permanently delete files, remove your access, change the password/emails, anything. And as you've given them your security you have basically made them co-owner and allowed them to do it.

Especially when there are inbuilt features to enable you to not need to do that (shared folders)

George H.33

This is a HUGE security hole. You shouldn't have to manually unlink to force a new password be entered.

The right thing is that if a user changes a password, than the current credentials on ALL linked systems should be immediately revoked, and a request for an updated password generated.

While I'm at it, an option to automatically unlink systems idle for a user settable time would be good - I just checked and I had 4 old cell phones and 6 old computers still linked but inactive - I should have an automatic method of cleaning this up.

George H.33

To expand a bit more, the standard action if a security breakin is suspected is to change a password, but on dropbox, as currently configured that's useless - once a "bad guy" is in to your account, i.e. linked, changing a password does no good - you have to take the extra unlink step, which I would wager most users have never heard of.

Mark

You shouldn't have to manually unlink to force a new password be entered.

Why? Its how most credentials work on machines.

It would do my head in having to re-link everything I had every time I changed my password - especially as I'm the only person who uses the devices.

I just checked and I had 4 old cell phones and 6 old computers still linked but inactive - I should have an automatic method of cleaning this up.

But that leaves the data on your devices. If you unlink via the website then you can ask Dropbox to wipe any data on it. You cannot do that if its unlinked. Nor could you track lost / stolen devices.

you have to take the extra unlink step, which I would wager most users have never heard of.

Personally I disagree. Most modern syncing tools/similar set up programs work on secure tokens. Changing a password on 99% of iOS device applications does not cause the linked accounts to re-request it for example.

George H.33

Most systems (e.g. windows) at least require a password entry on reboot - dropbox doesn't even do that - the old credentials are still valid across a reboot, at least on windows, and I suspect other platforms as well.

As far as other platforms not invalidating tokens when passwords change, that doesn't make it right - in fact, the right (i.e. secure) way to do this is to ask on password reset if the current tokens, links, etc. be invalidated. Just because other people jump off a cliff doesn't mean it's a good idea. The basic rule of security is to err on the side of too much authentication, not too little!

George H.33

You are right about my auto unlink suggestion, but that's easily remedied - just add the option on the auto unlink to erase the data, and make it the default. In my case, it's irrelevant - all of these devices are known to be dead or upgraded to new identities.

As far as tracking lost/stolen devices - I don't see how dropbox can help there anyway.

Mark

the old credentials are still valid across a reboot, at least on windows, and I suspect other platforms as well.

It is, thats right, because Dropbox doesnt run on passwords - as was said, it runs on tokens.

As far as tracking lost/stolen devices - I don't see how dropbox can help there anyway.

If a device logs in it keeps a record of the IP address. And I believe you can get security software that auto uploads images to Dropbox if people use/steal devices etc.

George H.33

but tokens can be invalidated from the server side, or rejected at boot time. Now you're just telling me because it's inconvenient to be more secure for the architecture, therefore it's secure - a very bad argument.

dh32405

I agree with George - I am in a similar situation. I used my dropbox on a work computer and after leaving the company realized it is probably still sitting there with access. I changed the password thinking that would stop anyone from getting into it and assumed all my other devices would need to be re-signed in with new password. No so, they all work without the new password - there must be a good reason it works like this, but I have no access to that computer to unlink. The only thing I can hope is that the overall computer password is not discoverable. I have changed passwords on all my web based accounts that are sitting in my chrome tool bar.(facebook, gmail, linkedin etc)

Rich

@dh32405 wrote:
I have no access to that computer to unlink.

As mentioned previously in this thread, you don't need access to the computer to unlink it. You need to unlink the device from your Account page on the Dropbox website.

[This thread is now closed by moderators due to inactivity. If you're experiencing a similar behavior, feel free to start a new discussion in the Dropbox Community.]