Last week I publicly (via Twitter—really what other venue is there?) mentioned that I might be leaving Dropbox. What ensued was a rather lengthy conversation between me and others as to why I would do such a thing. Soon after the conversation started, the folks at @Dropbox noticed and joined the discussion. Why would I think about leaving Dropbox, a service which I often cite as one of the most useful around for educators? One word answer: Privacy. Based on some recent reports, I now have reason to be concerned about the degree to which Dropbox can keep files secure and private. When I expressed these concerns via Twitter the folks at Dropbox responded with some helpful information, and an invitation to write their legal department with any concerns I might have (140 characters being insufficient for adequately addressing the matter. And as I said on Twitter, credit to Dropbox for listening and engaging in a conversation.)

I started to write such an email, and then changed my mind, why not publicly layout my concerns, and let other educators see what the issues are, after all I feel somewhat responsible since I have spent so much time praising Dropbox. Rather than have a private dialogue with Dropbox it would be better to make it public, yes? So here goes.

The Background:

For those that don’t use Dropbox, think of it as an automatically syncing flash drive in the cloud, an excellent way to keep files synced across multiple computers and have them available on whatever device you have in front of you at the time. (Here is the official explanation.) Because of Dropbox I never need to carry assignments, syllabi, or journal articles that I want to read with me, or on a flash drive. These are just stored in the cloud and I can access them anytime the need arises. And this is just the tip of the ridiculously useful iceberg that is Dropbox. If you want more, just look at all the times it is mentioned on Profhacker (or just Google Dropbox uses and see what I mean). Dropbox has become one of the most important services in my media/computing ecosystem. On a scale of one to ten for usefulness and ease of use Dropbox is an 11.

The Problem:

About a month ago I started to see reports that expressed concern over Dropbox security, questions about the encryption being used, and who has access to the files you store on there servers. Basically there are to two sets of concerns. The first is that by design Dropbox is insecure. You can read the whole article, which is mildly technical but amounts to a concern that it would be fairly trivial for a nefarious party to steal one file and thus gain access to all your files without you necessarily knowing. The second is that Dropbox updated their Terms of Service to reflect the fact that they have access to your files if needed. In other words if the government subpoenas Dropbox, Dropbox has the ability to turn over your files in unencrypted form to the officials. (I know what some of you are thinking: Who cares, I am not doing anything illegal? . . . but wait I promise you should.) Both of these issues boil down to the fact that the encryption of your files takes place on the Dropbox servers, not on your own computer. In other words the question is who has the keys to your file(s) and where are those keys stored.

One way to think about this concern is to imagine your files are being stored in a lock box. One way to do it would be to put the files in a lockbox keep the key and send the whole box to Dropbox. In this way Dropbox has no way to unlock the files. But rather than this method what Dropbox employs is a technique whereby you send them your files they place them in a lockbox and give you the key, but have another copy of the key that lets them look in your box anytime they want. Why would they do it the second way instead of the first? Several reasons but I think there are probably two main ones: 1. Ease of use for Dropbox customers. A system where they (the server) handle the encryption rather than one where you manage (the client) has several advantages including a “lighter” Dropbox program on your device since it doesn’t have to handle encryption and the ability to retrieve files for you, even if you forget or lose your password. 2. Dropbox doesn’t want to cross the government.

Dropbox has responded to these concerns with a lengthy FAQ, which I encourage everyone to read. But, honestly the FAQ troubles me, and makes it even more likely that I will seek an alternative cloud service as it leaves many questions unanswered.

My Concerns:

Lets start with the transparency of this issue. What Dropbox is claiming, or appears to be claiming is that this change in the TOS does not reflect a policy shift, but merely an attempt to clarify what has been the policy all along. I’ll take Dropbox at their word on this, but I still have concerns about their wording.

“That said, like all U.S. companies, we must follow U.S. law. That means that the government sometimes requests us (as it does similar companies like Apple, Google, Skype, and Twitter) to turn over user information in response to requests for which the law requires that we comply.”

What Dropbox seems to be implying here is that they are required by US Law to have what is known as a backdoor key (the ability to unlock any file) and give it over to the government when served with a subpoena. But this is not actually the case. If Dropbox has the ability to unlock the files yes they have to give that over if they receive a request. But that doesn’t mean that they have to build a system that would allow them to do this. In other words if they didn’t have the ability to unlock your files the government couldn’t ask for that key, because Dropbox wouldn’t have the ability to unlock said files, they could only give over the encrypted versions of the files to the government, rather than the actual files themselves. This is what is essentially the issue in this article, about the government wanting to be able to WireTap the Internet. My understanding though, and I have asked a few lawyers about this, and their opinion was that the current state of the law does not require companies to serve up plaintext files.

Okay, at this point I hear many of you saying that you want this feature, that you want the government to be able to access the files of “the badies,” and since you have nothing to hide from the government you are not concerned. Let’s table that for a moment, and I’ll explain in a second why this is a dangerous view, but for now, irrespective of this issue there is a more significant one, which affects every user, regardless of whether or not you feel that you have something to hide from the government: A system which by design enables a third party to decrypt your files, is by design not secure. Or, a secret between two people can only be kept if one of them is dead. A system which by design has a backdoor to enable third party access is vulnerable to a security breach. As a way of thinking about this consider the relatively recent case where a Google Employee was accessing user email and chats. Yes, Google is concerned about user privacy, but any system, no matter how good the engineers has holes unless the user is the only one with the keys. So here is the rub, by trusting Dropbox and their current system you are not just trusting Dropbox but a host of employees. Any system designed like this will have a security breach at some point. It might not be a large one, it might not affect many users, but it will happen, you are just rolling the dice, gambling that you are not going to be the one effected (a fair gamble in most cases). Its not just software that you are trusting, but people, and people are usually the weakest link in any system.

Now just as importantly for me is the type of atmosphere this private-government partnership entails. I realize many of you might not agree with this, and I don’t want to turn this into a big discussion here (a discussion I am more than willing to have in other places), but I prefer to play corporate interests against the government, keep those two forces working against each other, rather than siding against the public. One of the particularly damaging developments we have seen in the web over the last 5 years is the ability of governments to control what happens online thru extra-judicial means, collaboration with companies to curtail our privacy. For me at least it isn’t a matter of having something to hide from the government, but rather knowing that I maintain control. Control of my own data, and the data of others who have entrusted it to me seems to be an essential component of dignity.

But What Do I Care?

You don’t have to imagine that the government would want your information to see some problems here. Let’s imagine that through an engineering problem (a problem with the code), an employee problem (see Google case above), or a deliberate hacking attack, Dropbox files suddenly become available. I actually have a good deal of student work, evaluations, letters of recommendation etc. stored there at any given time. Aside from my own paranoia about data and privacy there is a good bit of data that students and others with whom I work are entrusting me to keep private. Lets imagine that your grade roster is stored on Dropbox and that gets compromised. Once that file is unlocked and passed around there would be no getting it back. Leaving aside what kind of FERPA violation this may or may not be, I can imagine many students who might be harmed by this type of info. Have you stored judicial letters (for plagiarism cases) on Dropbox? I can think of a lot of information that I wouldn’t want out there even if it wouldn’t directly harm me.

Now about 80% of the stuff I store on Dropbox has no privacy issue associated with it, things like journal articles or chapters I want to read, or syllabi & assignments, or my running schedule, or stuff that is publicly available elsewhere like my CV. But there is enough there that I am concerned and looking for other options.

I will also note here that given the recent FOIA filings by conservative groups going after professors that being paranoid about data isn’t a bad thing, removing the option from others to share my data (this is why I use my own email more than I use the University provided one).

It’s true I have become somewhat paranoid here, using a VPN when on campus to ensure that the University can’t monitor my internet use, but I don’t think you have to be too paranoid to see this as an issue.

Questions for Dropbox

Having said all of this I think there are probably several things Dropbox could make clear that would help.

1. How many employees have access to user files? Is there a dual control system (do two employees have to sign off on access, or are there are a certain number of employees who can do so on their own)? Are records kept anytime users files are accessed this way, so that the company creates a clear audit trail? Do employees (and or any contractors they deal with) have background checks?

2. Under what conditions do they give the government data? The FAQ suggests that they would fight these requests if they found them to be lacking in merit. Have they done so? Can they make transparent this process? Hard data on this?

3. What is being done to fix the architecture issues? (Here Dropbox runs into a problem as the more it says about its security the more susceptible it is to vulnerabilities, but the less it says the less trustworthy it seems. Security thru obscurity really isn’t a good idea.)

4. Does Dropbox think it is their legal responsiblity, ethical responsiblity, or both to share information with the US government? Would they do so without a warrant? The policy says “request” what constituents a request?

The Other Options

1. As the Dropbox FAQ suggests the first option is to encrypt your file before it syncs with Dropbox. If you encrypt your files before syncing them with Dropbox, using something like TrueCrypt, nobody else will be able to access them. The disadvantage to this is it makes it such that your files are not accessible on your iPhone, iPad, or Android device. In other words a not so useful option.

2. Use Dropbox only to store public, or pseudo-public information. Again 80% of what I store on Dropbox I am not concerned about so maybe I just only store that type of stuff on Dropbox.

3. Go back to using a flash drive. (Uhh, no thanks.) This also doesn’t let me use it across other platforms (iPad, phone, etc.)

4. Create a partition on my phone that would store these files. They would always be with me, and I could run something like Samba File sharing and Root Explorer. This would make it more than trivial though to access the files. Really I like cloud features.

5. Switch to a different service. Both SpiderOak and Wuala seem to offer services similar to Dropbox which encrypt the files on the user side. Both of these have applications for all the devices I use (iPad, Linux Computer, Android Phone).

6. Set up my own Dropbox type service on my home computer. Sure this can be done, or I can just run a VNC back to my computer and fetch the files I want, but this is less than optimal. There is also an open source Dropbox being developed, called Sparkleshare.

7. Pogoplug. Pogoplug works by creating your own cloudserver at home.

There is one meta-issue here. As the leader in this type of service, many other applications rely on, and provide support for syncing with Dropbox, for example iAnnotate or GoodReader—usability that would be sacrificed by switching services. And as the easiest and most frequently used, Dropbox is the easy one for me to recommend to faculty members who are less than computer savvy.

Right now I am investigating SpiderOak, Wuala, and PogoPlug. I will let you all know what I discover. My preferred option though would be for Dropbox to address the current issues, cause you know I really do like their service.



• NetNewsWire: Clearly I have an RSS addiction. This is the way I track what is going on in the field, in academia, and the world at large. While there are several RSS reader options, I prefer NetNewsWire. The ability to sync across multiple computers, plus read while offline, and save clippings (which also sync) are crucial for my work flow. I would like the ability to share items (i.e. GoogleReader) but the other features make NNW my choice.
• Twittelator: Again no secret but I use twitter for a range of academic and personal functions. There are many iPhone twitter apps, but this is my favorite (I actually purchased the pro version). Others I know use Twitterific, or Tweetsville, but the copy and past feature for retweeting got me hooked on this one early, and just haven’t found a reason to change.
• TextGuru: I tried several “mini-word processor” apps for the iPhone and this one ended up winning the prize. Not that I intend to compose a chapter or article on the iPhone or anything, but having a way to type or edit a document does come in handy. This one handles a wide range of formats, and most importantly allows input in landscape mode, which makes typing a whole heck of a lot easier. You can also transfer files wirelessly between your computer and the iPhone.
• Snatch: Simple and exactly what I wanted. When the iPhone apps first came out I was disappointed to learn that Remote only worked for iTunes and FrontRow (stupid). Seriously, all I wanted was a replacement for that stupid IR remote that meant I had to stand behind my computer when presenting. Snatch allows you to use the iPhone as remote control for the mouse/trackpad, or just a clicker. I also gave StageHand a shot, and it has the added feature of providing your presenting notes to you on the iPhone, but really all I wanted was a clicker.
• Wikiamo: Of course I want access to Wikipedia anywhere. Again, I tried out several applications, and while I wish Wikiamo had collapsable sections like iPedia+, it is simply much faster, and remembers past searches.
• OmniFocus: Expensive, but syncs with OmniFocus on my computer and provides location aware contexts. GTD FTW.
• Evernote: I haven’t fully leveraged the power of this app yet, but I still use it to record, take quick pictures, and generally preserve things in the short term that I might want to access later.
• WordPress: Again not like I am going to be doing any long blogging from the iPhone, but since I use blogs to organize/run my classes, this app lets me update them from anywhere.
• SnapTell: This is one of those “magic” how does that possibly work apps. Take a picture of a book (DVDs and Video Games also work), the application accesses the internet, looks-up said book and tells you where it is for sale on the internet. Seriously, from just a picture it can “read” the title and look it up. I use this less for online shopping and more to take pictures of books I want to order later, check out from the library etc. Forget having to write down or type the title, just snap the picture.

What did I miss? Leave it in the comments.

• First up is an article by Michael Wesch, A Vision of Students Today (& What Teachers Must Do). The article appears on the Britannica Blog, an institution I do not always associate with progressively thinking about how technology changes knowledge production. Nevertheless Wesch’s piece is worth a read for he navigates the precarious but important middle ground between being a luddite and being techno-utopian, instead claiming that there is nothing new about the notion of playing the “getting by game,” even if the means by which this game is played is different. Ultimately he suggests a rather simple solution: Public Academia.
• Group Table: Group Table is another web application in the list of online collaboration/group organization tools. While there are many out there, most people I know prefer Bassecamp and Backpack, Group Table is focused on specifically serving the student population.
• Open Huddle: When I was searching for free online tools for hosting my virtual grad class, I looked into many (way too many) options. (I just needed chat function, so in the end ended up using a chat program but I digress.) But, Open Huddle was one of the better ones people sent me. Unlike Group Table (above) which is focused on organizing the group, Open Huddle’s purpose is to provide a set of tools for collaborating in real time. Open Huddle has video chat and a drawing board (think virtual white board) as well as allowing messaging and file sharing. My guess is in the future we will see a lot more of these types of sites for robust online learning and collaboration.
• Last but not least, watch Antonio’s presentation on using YouTube as a Classroom Resource.

A rather mundane question I have for you. . . have you encountered something that could help make the reading process easier for digital documents? Something akin to dragging a colored index card along a page quickly as you read? I am a very fast reader with paper, but find my eyes wandering when looking at a screen. . . . My admittedly uninspired work-around is creating a word document, restoring down the screen, and using the little blue header to pull down on top of the digital document as I read. . . but a better solution would be just a colored floating bar that you could pull from your desktop and use as you are reading.

Anyone know of something that would work? Mac and/or PC?

The significant change this last week in the iPhone though was not GPS or 3G network access, but rather the ability to put applications on the phone, allowing users to customize the phone and drastically increase its usefulness. I have had the iPhone since last year and noticed it allowed me to leave my computer at home a lot more, and now with applications I can see this being even more the case. There are a lot of educational possibilities for something like this once more students and instructors have access to mobile computing devices, but for now I thought I would mention the iPhone applications which have a place on my mobile computer already. Most are free, or really cheap. (Note: I have more apps than those listed here, but these are the ones that I already use for academic purposes, or know I will once the semester starts.)

• BookZ ($1.99): Reading books on a mobile device (Kindle, Sony eReader) doesn’t quite measure up to the analog device yet, the user interface for the paper copy is still significantly better. That having been said, it is still useful for me to carry around a book or two on the phone to read, or consult when needed. While there are several book readers already available for the iPhone, of the ones I tried this was my favorite. The ability to customize the font size and type is perhaps the most important feature. Now anywhere I go I can get a text from Project Gutenberg and read away. I even read Doctorow’s Little Brother this way.
• Twitterific (free): No surprise here given my appreciation for microblogging. Hopefully an application like Twhirl which handles multiple microblogging services will soon be available for the iPhone.
• WordPress (free): Since I use blogs as my basic course management software having access to them via my mobile device is important if I want to rely only on my phone. Now I can post class updates, amend prior posts etc, all without a computer. WordPress supports multiple blogs, making it easy to post to all of my classes. I was hoping for MarsEdit mobile but this will do for now.
• NetNewsWire (free):Still a little buggy, and it doesn’t have all the feature I want, but I can now keep up with The Chronicle, Inside Higher Ed, and all of the blogs I follow from anywhere.
• OmniFocus ($19.99): Okay I know what you are thinking $20 for a phone application. But Omni makes great software, and the ability to carry my GTD sorted todo list with me anywhere and have it sync to my computer at home is worth the price. Couple that with location aware contexts (“I see you are on campus, here are the things you need to do”) and you have the killer todo application.
• Wikipedia (free): This is the only web app (i.e. you don’t download this from the store it is just a webpage to access) on my list. Wikipedia anywhere is useful but this bookmark goes to a web optimized version.
• FileMagnet ($4.99): FileMagnet lets you transfer files from your computer to your iPhone. In other words carry your syllabi with you everywhere, or any .pdf file for that matter.

(Brief mention for my favorite non-work related iPhone app: Urbanspoon.)

Any other academically useful iPhone apps? or requests for apps?

Update: Liberal Education today links to some of the more science oriented apps.

No, that is not a screen shot of Keynote, it is from an online slide creation tool called 280Slides. The interface though is so similar to Keynote that one might accuse them of just ripping off Keynote, stripping it down and turning it into a web application. Indeed in reading thru the few blog posts it seems that the developers have a Mac bend. Given my preference for Keynote over PowerPoint (“Power Corrupts. PowerPoint Corrupts Absolutely“) one might guess that I like the interface of 280Slides. Like Keynote it is designed more towards a visual presentation and less towards putting text on slides.

280Slides is relatively easy to use, and comes with the advantage of other web applications, i.e. working from any computer, accessing your presentation from any browser, not worrying about file compatibility, etc. And, while I might prefer 280Slides to something like Google Presentation, this still finishes a distant second to SlideRocket (which I reviewed here).

(Thanks to Pedagogical Gregory who sent this to me.)