Child Item

Reminder: The Dropbox API will no longer accept TLS 1.0 or 1.1

Beginning on or after April 13, the Dropbox API will require that calls use TLS 1.2 or greater. Traffic using TLS 1.0 or 1.1 will be rejected.

The latest Dropbox SDKs will select TLS 1.2 when available in the environment, but versions over two years old may require an update. In particular, users of the Dropbox Java SDK should update to v3.1.1 (released June, 2019) or later & Dropbox Python SDK should update to v8.4.1 (released November, 2017) or later.

TLS 1.2 has been the default on major mobile & desktop operating systems since 2014. Developers whose application may be run in older or unusual environments should investigate to ensure compatibility.

Please ensure your apps use TLS 1.2 when connecting to the Dropbox API.

Find more posts tagged with

API

Abuse

Comments

Eric Z.6

Hi Dropbox,

We are currently using the following version in the Android apps.

implementation 'com.dropbox.core:dropbox-core-sdk:2.1.1'

We will update to the required version. But development, testing and user update will take much more than 1 month left. We ask Dropbox to give us more time to comply.

Thanks for the consideration.

Robert S.138

I received an e-mail from Dropbox warning that "your app(s) TuneLab Tuning Files have recently made calls to the Dropbox API using a deprecated TLS protocol version." I thought we had updated both our iOS and Android versions over a year ago. I suppose it is possible that some users of our apps have not updated in all that time, but I would like to know if there is any test I could run to see whether or not the latest versions of my apps are using the deprecated protocol. My inspection of the Android code shows the external library of com.dropbox.core:dropbox-core-sdk:3.1.5, which should be OK. And the iOS code uses cocopods and references ObjectiveDropboxOfficial and a README.MD that says "The Official Dropbox Objective-C SDK for integrating with Dropbox [API v2] " which should be OK too. The source files are dated 11/3/2020. So that should be OK too. But I don't trust this as proof that my apps are not using the deprecated protocol. So how can I run a test to know for sure? Is there a way I can simulate April 13th now? Or monitor traffic? The e-mail I got from Dropbox has got me worried.

Mark R.5

I would second that request of a simple test for peace of mind.

I also got that email, but my apps have should have been using compliant versions of the SDK for many years...

Greg-DB

@Eric Z.6 Thanks for sharing this feedback. At this time I am unfortunately not able to offer extensions for this change, but I’m sending this feedback along to the team.

For reference, we did send earlier advance notices about this change by email last year, but it sounds like those did not make it to you. For instance, perhaps they were caught by a spam filter. Please make sure that the email address on the account that owns your API app(s) is correct and can receive email. Additionally, make sure you haven't unsubscribed from "API announcements".

Greg-DB

@Robert S.138 @Mark R.5 If you’ve already updated your app, this traffic may be coming from users still on an old version of your app. You may want to notify your users to update to the latest version of the app. We don't have a way to simulate the change, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though. If you'd like additional help verifying this, feel free to open an API ticket from the account that owns the app(s) in question and we may be able to offer some help.

DreamingDev

Hi Dropbox,

We have received the mail regarding to this issue, stating that:

"We’re reaching out because your app(s) ... have recently made calls to the Dropbox API using a deprecated TLS protocol version."

We would like to confirm the following:

1. Does that mean our app did make calls using a deprecated TLS protocol version so that we received this mail? Or, is this just a notification regardless of whether our app communicates with deprecated TLS protocol version?

By testing with our app, it seems that the latest version of our app uses the TLS 1.2 and 1.3 protocol version. If receiving this mail is a proof of using deprected TLS protocol version by our app, then the only possible reason may originate from some of our customers who still uses older version of our app, which may be kind of wierd. Also, do you have any recommended way to test on which TLS version our app is really using?

2. We are using the curl library to send API to dropbox with the setting of CURL_SSLVERSION_TLSv1. Under this setting, although it seems that we will use the TLS 1.2 or 1.3 (depending on the version of curl library), in case we may still send with TLS 1.0/1.1, we would like to know after the deprecation of TLS 1.0/1.1 on April 13, will the request be fallback to use TLS 1.2 or 1.3 automatically? Also, is there any approach to test this situation?

Look forward to your reply, thank you!

Robert S.138

Can you at least confirm that the following is sufficient for avoiding the deprecated protocols:

In the Android version of our app, the build.gradle file under the app folder contains:

dependencies {
. . . .
implementation 'com.dropbox.core:dropbox-core-sdk:3.1.5'

. . . .
}

and in the iOS version of our app, all the files in all the subdirectories of:

Pods/ObjectiveDropboxOfficial

have a file date of 11/3/2020.

If it is not sufficient, tell me what else I could check.

Greg-DB

@DreamingDev 1. If you received that email it means your app sent some amount of TLS 1.0 or 1.1 traffic to the Dropbox API recently. If you’ve already updated your app, this traffic is likely coming from users still on an old version of your app. We don't have a way to simulate the change, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.

2. I can't provide support for specific third party network clients as they're not made by Dropbox, but in general yes, network clients should automatically use the best available and compatible protocol version. As above, I can't offer a way to test this ahead of time, but you may be able to enable some logging on your network client to check the protocol version being used.

Greg-DB

@Robert S.138 Yes, Java SDK v3.1.5 is sufficient. And likewise a version of the Objective-C SDK from late 2020 would also be sufficient.

Mark R.5

Hi Greg. It would be good to clarify the exact versions involved here for various SDKs. Just to recap what the original email sent out in Aug 2021 said:

1) SDKs over two years old may need updating (so I presume from Aug 2019 and earlier).

2) The Java and Python SDKs have specific versions that need updating to

Based on that I had no concerns since I was not using an SDK that old, and was not using either of the SDKs mentioned. So I am a little surprised to see you mention that the Obj-C SDK may need updating to late 2020, since this is obviously later than 2019, and the SDK was not mentioned in the original email. Could you please clarify what is the exact minimum version number of the SDK required to update to for the following versions of the SDK:

1) Objective-C

2) .NET

Many thanks.

Greg-DB

@Mark R.5 Thanks for the feedback. To clarify, I was not indicating that one would be required to update to an Objective-C SDK from late 2020. Rather, I was responding to Robert's specific question and confirming that such as version should be sufficient. I don't have specific versions of the Objective-C and .NET SDK to note. The system should automatically use the latest available version. The Java and Python SDKs were only called out in particular since those were more recent and contained code that would affect the version used. If you need help confirming anything for your app(s) in particular, please open an API ticket.

Mark R.5

Ah, I see. I read the date 11/3/2020 as being in March (being based in the UK), so assumed you were suggesting that he update to a later SDK. I see now that he meant (or at least you thought he meant) that it was an SDK from November, which you were confirming should be fine. All good.

Robert S.138

Even without a specific test for use of the deprecated protocols, there is one thing Dropbox could do to help us know if we have a problem with our latest version. In the e-mail that goes out to developers telling them that they detected "some activity" with the deprecated protocols, why not include something more quantitative? Tell us, for instance, the percentage of deprecated uses. If our current versions are indeed faulty, then 100% of the accesses will involve the deprecated protocols. But if only 7% of the accesses are problematic, then we can rest easy knowing that the 7% must represent users who have not updated their apps. Dropbox has the data, right?

Greg-DB

@Robert S.138 Thanks for the feedback/idea! I can't make any promises myself, but feel free to open an API ticket if you'd like to request specific help/information.

Eric Z.6

We are currently updating our apps to comply this change. But development, testing and user update will take much more time. We ask Dropbox to extent the deadline.

Thanks for the consideration.

enpapi

We are using libcurl and are sure it will fall back to the appropriate protocol as reported by the Dropbox API server. However, the final results depend upon the configuration of the server too.

Is there a way to test or simulate the API server changes before 13th?

Greg-DB

@Eric Z.6 Thanks, I’ve sent your feedback along to the team.

Greg-DB

@enpapi The Dropbox API servers currently support TLS 1.2 and will continue to do so after support for TLS 1.0 and 1.1 is disabled. Dropbox doesn't offer a way to simulate the new server configuration, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.

MarioEM

Dear Greg,

My Android application has been upgraded last year to use Dropbox-Core-SDK 4.0.0 dated 30.3.2021. I am also using okhttp-3.11.0 from August last year.

I am very concerned that my Android app may not be fully compatible with the TLS 1.2 protocol, required from April 13.

How can I check to ensure my Android application is fully compatible with Dropbox TLS 1.2 requirements ?

Please advise.

Kind regards

Mariusz

Greg-DB

@MarioEM That version should be sufficient. If you need help confirming anything for your app(s) in particular, please open an API ticket.

dodnewtech50

Hello there,

I am attempting to update my application to be able to work with TLS 1.2. I have updated my dropbox module to version 11.7.0 in pythonista. Now I get the following error: Timeout value connect was Timeout(connect=100, read=100, total=None) but it must be an int or float

I have two questions: 1) Do you have any suggestions on how to address this error?

2) Do I need to update my API token now that I've made these changes?

Greg-DB

@dodnewtech50

1) I believe that was a bug in an older version of the 'requests' library. Please update the version of 'requests' you have installed and try again.

2) No, these TLS changes do not require you to change your access token(s).