Child Item

Dropbox Paper Security Issue

Ruslan_Taghiyev

Everybody with the link to my paper file has access to it even if I didn't grant it.

How to reproduce:

1. Create a new paper file(do not share it somehow)

2. Copy the URL from the browser

3. Open this URL in the incognito mode(Or anywhere where you are not logged in)

Expected:

- 404 or 403

Actual:

- The page opens and you can view the file

PS: I've searched how to open a bug, or contact Dropbox support, but looks like you can't do it if you don't have a business account.

Find more posts tagged with

View

Web

Dropbox Paper

OffTopic

Closed - Not for right now

Accepted answers

Jay

Hi @Ruslan_Taghiyev, we appreciate the feedback about the sharing of Paper files. Currently, it isn't possible to prevent the default sharing of all your Paper documents.

All comments

Walter

Hi @Ruslan_Taghiyev - thanks for taking the time to share your thoughts on this on our Community.

While Paper has a setting that allows anyone with the link to access a Paper doc, we warn users who try to access a doc owned by another team or a user not on their team that their information will be visible in a screen that pops up before the Paper doc loads.

Displaying this information is needed to enable collaboration and security features for our users. Users and admins can control who can view a Paper doc in our settings.

For more information you can take a look here.

I hope this helps a tad.

Ruslan_Taghiyev

Hi Walter, thanks for the fast answer!
So as I understand, by default, all my documents are shared with anyone who has a link?

That's pretty odd to me because in the docs list it says "Shared with": "Only you".

Screenshot 2023-02-27 at 20.06.24.png

But it's not true, because until I go to the document settings and set "Unshare file" it's shared with anyone even without asking them to sign in, so I can't even know who viewed my file.

Screenshot 2023-02-27 at 20.07.03.png

I think it's very misleading and from my experience document should be shared only after you enable this sharing manually, not by default, that is why I thought it was a bug. Is there some setting that I can enable so that all my documents will not be shared by default?

Jay

Hi @Ruslan_Taghiyev, we appreciate the feedback about the sharing of Paper files. Currently, it isn't possible to prevent the default sharing of all your Paper documents.

Ruslan_Taghiyev

Hi Jay, I'm sorry to hear that, but thank you for the information