Child Item

Why So Much Telemetry ?

Hi All,

My Pi Hole is blocking an INCREDIBLE amount of DropBox telemetry, even more than Windows telemetry, and by a large margin.

So I have a few questions.

1. What is this telemetry for ?

2. What information is in there ?

3. Who gets to see it (ie, is it shared in any way with, let's say, advertisers)

4. Why is it being blocked by my standard Pi Hole list, what threat could it be ?

5. Where do I turn it off if I wish to ?

Cheers,

Threlly

Find more posts tagged with

Security

Disagree

Comments

anforowicz

Hello,

I am a Chrome Engineer, working for the Chrome Security team. In Chrome 85, a security feature called CORS-for-content-scripts has shipped - after Chrome 85 content scripts can no longer bypass CORS, even if an extension has permission to the target host. The Chrome 85 changes have been announced in March 2020 on chromium-extensions@ discussion list, as well as in Chrome Enterprise Release notes.

The "Dropbox for GMail" Chrome Extension has been identified as affected by Chrome telemetry in earlier Chrome versions. An email notification to CWS@dropbox.com (the email registered in Chrome Web Store) was sent out in June 2020. To avoid disruptions, the extension has been put on a temporary "allowlist" that exempts the extension from Chrome 85 changes (as we've announced earlier, the "allowlist" is being removed in Chrome 87). Our manual testing indicates that the "Dropbox for GMail" Chrome Extension has not yet migrated to the new security model and will stop working in Chrome 87 (starting with version 87.0.4266.0, currently in the Chrome Canary channel).

Please migrate the "Dropbox for GMail" Chrome Extension to the new security model as soon as possible. The tentative Chrome 87 release schedule is to ship to the Beta channel on 2020-10-15 and to start rolling out the Stable channel on 2020-11-17. More details about the changes and migration guidelines are available at https://www.chromium.org/Home/chromium-security/extension-content-script-fetches.

Best regards,

Lukasz Anforowicz

Walter

Hi @anforowicz; thanks for the extensive report and welcome to the Dropbox Community!

As I'd like to get this under the attention of one of our experts, would it be OK if I used the email address that's connected to your profile here on our Community to further investigate?

Thanks a bunch, Lukasz.

anforowicz

RE: would it be OK if I used the email address that's connected to your profile here on our Community to further investigate

Sure, that should be totally ok. Thank you for asking.

-Lukasz

Walter

Thanks for the swift response, Lukasz.

I just sent you an email so we can investigate further.

Whenever you get the chance, please take a look at your inbox for my message and we'll take it from there.

Threlly

Walter

Hi @Threlly; welcome to our Community!

I'm not aware of this exact domain and as a matter of fact is not listed within our official domains. Can you let me know some additional information about the device you're seeing this on, such as if you're running the desktop application and/or if you're using a web browser to access a Dropbox account etc.?

Regarding your last queries, I'd suggest getting in touch with the 3rd party app you mentioned directly as they might have more information.

In any case, please let me know what you find, Threlly.

Threlly

Hi,

I'm using the Windows 10 desktop app v106.4.368.

I rarely access dropbox in the browser.

Even if I quit the client the DropBox service (DbxSvc) remains active in my task list, as does "DropBox Update 32bit".

Gary

Threlly

The traceroute site interpreted the url as telemetry.v.dropbox.com, so I tried another site.

The final IP, 162.125.19.9, is owned by DropBox.

Threlly

Hi Walter,

All gone quiet.

Dropbox is still siphoning unknown amounts of data from my PC to an address that Dropbox own but have not added to the list of official addresses.

Even though I have turned off telemetry & metadata being sent back to Dropbox in my settings, this is happening in the background with no control.

I'm based in the UK, so for now, still in the EU. This looks like it circumvents GDPR rules in Europe.

Do you think anybody from DropBox will respond ?

Best,

Gary

Walter

Thanks for the nudge on this one, Gary.

I've sent you a ticket to the email address that's associated with your Community's profile so we can investigate further.

Whenever you get the chance, please take a look at your inbox and we'll take it from there.

GlynH

I'd like to know the answer/outcome to this as well.

I installed Pi-hole less than 3 hours ago and so far 208 blocked calls to telemetry.dropbox.com and a further 10 entries since I started this email!

It's a bit worrying when it doesn't appear in your own list of recognised domains and you don't seem to know what it is...

Thanks & kind regards,

-=Glyn=-

JingleDjango

I'm following this thread with interest.

edie828

I read the "fix" script. No way am I equipped to figure this out. Is there a plain English version that I can access? My business is being severely affected by what I think this problem is.

When I try to download the attachment to the dropbox using the chrome extension (in ANY of my gmail accounts), nothing happens. Everything was seamless and problem-free until a few days ago.

Walter

Hi there @edie828; thanks for joining our discussion here.

May I ask which exact version of Chrome are you noticing this on and if it persists after clearing your browser's cache?

Thanks!

edie828

Version 85.0.4183.121 (Official Build) (64-bit)

Lusil

Hey peeps, thanks for your additional reports.

If you haven't already, could you submit a ticket to our team from this link, so that they can look into this with you?

If you have any trouble creating a ticket, just give us another nudge and we'll be more than happy to send you one.

Keep us posted!

Threlly

Hi,

Curious that this cannot be identified quickly.

The url and IP address belong to Dropbox.

The internal applications & security team should be able to say exactly what this telemetry is as a matter of routine.

Quite alarming that dropbox are not aware of what their own net facing interfaces are doing.

I don't need to remind anybody that this is essentially a matter of trust.

Best,

Gary

GlynH

Yeah I'm really concerned about this also. Seems like a deliberate attempt to ignore what I believe to be a fair & reasonable question.

For those who may be interested Pi-hole reports;

Top Blocked Domains

telemetry.dropbox.com 1958

It's currently #2 in the list after Amazon which is nothing to be proud about IMHO!

Bearing in mind I have not used Dropbox nor rebooted any machine it is installed on I find the amount of hits very concerning.

Should I just add it to my Blacklist? WIll this have any effect on Dropbox?

Can someone from Dropbox please step up, take ownership and at least have the common courtesy & professional integrity to reply rather than ignore please?

Thanks & kind regards,

-=Glyn=-

GlynH

And in just a day the queries to the super-secret-squirrel-site has now surpassed that of Amazon!

Top Blocked Domains

Domain Hits Frequency

telemetry.dropbox.com 2694
device-metrics-us.amazon.com 2617

If I hear nothing from Dropbox soon I'm going to consider it a bad actor and block it.

In fact I don't really use Dropbox much at all these days so I might just 'Drop' them altogether.

Such a pity I recently paid them $120 for another year...

-=Glyn=-

Jay

Hi @Threlly, @GlynH, and everyone else in this thread, thanks for your patience.

Our dev team have informed us that they use telemetry.dropbox.com as a channel to receive client side logging, error reporting, and other metrics. This is listed as a trusted domain since the primary domain itself is 'dropbox.com'.

The Pi-Hole add-on marks ‘error reporting domains’ which is what we are gathering through that web path.

I hope this information helps to clarify matters.

Threlly

Hi Jay,

I thought I’d turned that off, nor do I want to share information that I have no control over.
How do I turn this off ?
Who is this information (in any form) shared with ?

Thanks,
Gary

Jay

Hi @Threlly, currently, it isn't possible to disable this via the Dropbox desktop application.

The information would be sent to the dev team, to further improve the Dropbox desktop application.

Threlly

Hi Jay,

Well that’s me out.
It’s constant and I have no control of data being sent from MY machine, especially when I have purposefully clicked the option that turned that off.
So it turns out that we have all been deceived.
If I want that turned off, that’s it. Period.
I’ll migrate my data to another service.

Please note: I must also refer this to European GDPR, as Dropbox are clearly not compliant.

Thank you all for your patience and help.

Kind regards,
Gary

medall12

I found this thread because my pihole is also blocking a CRAZY amount of telemetry.dropbox.com and I fully agree with Gary. We MUST have the option to share our information or not to share the information if that is what we choose. I am very dissapointed in these findings. I will also be looking in to another service to migrate to that is more transparent.

doni

Also fully agree w/ the other annotators. one callback per minute is way too much and not providing an option to turn off undocumented!!! telemetry is even worse. This is a 'good-bye trigger' for me. I also think this is not GDPR compliant. Dropboxers, your data protection seriousness is way too lazy!

thisIsBad

I followed this thread ever since I discovered the amount of data dropbox is siphoning under our nose.

It seems that you are right that this is no compiant of European GDPR. If Dropbox doesn't do something and earn back our trust, I see a class-action lawsuit coming their way.

eagerish_nuthatch

Also discovering this thread while researching why my pi-hole is blocking such a lage amount of traffic for a service I pay for.

Hits in 24 Hours:

Screenshot from 2020-10-21 06-35-47.png

Jay

Hi everyone, I've checked again regarding your concerns and have the following information on the telemetry domain.

Using our Telemetry alias, we do not gather any data that is related to GDPR. The data gathered through this alias is user and device agnostic. This alias primarily reports error logs to our team to better improve our product.

Our privacy terms and conditions has more information on what and why we collect certain data. You can view that information on this page.

Threlly

Hi Jay.

Thank you.
How do we opt out ?

Best,
Gary

Threlly

Hi Jay,

By the way, I did not accept the post as a solution, that was a finger slip.

If you can revert please do so, if not I'll raise another post for the issue.

Cheers,

Gary