|
dropbox security - lack of
i am putting this here as a new opbservation but happy for it to be moved to other forums as its not a CC specific comment
i only just discovered that moon reader has FULL access to my dropbox, AND has a handy browser under its my files tab that will navigate to any file in any folder of dropbox, and let me read it or even delete it
I had assumed that its access was restricted to what its been asked to do - i.e. sync last page read to a specific dropbox sub folder that it creates for tha purposet, and to make app preferences backups. I am somewhat horrified that everything in all of dropbox can be seen by anyone who opens moon reader on any of my tablets. OK - I am sort of safe in that the tablets never leave the house but I may need to rethink the whole area
i looked through all of my connected apps permissions at dropbox.com, I saw that a couple had restricted permissions e.g. mantano had a file type restirction, and something else had a folder restriction, but I could not see how to downscale moon reader's permissions from full to something more sensible.
I guess that CC, where it still works, also has FULL permission, though its not quite to easy to view other dropbox folders in CC
also, the connected apps permissions list is just apps, it is not apps+device combinations, so if moon reader on device A has full permission, does that also grant same permission to Moon reader on devices B, C D...
and finally, if apps such as Moon, Mantano/Bookari, CalibreBox can so easily still get full access permissions for dropbox, why is it so hard for CC do do the same ?
the moon reader app with full permissions was only installed yesterday
|