Enhancing security for Dropbox folders on shared macOS systems

Dear Dropbox Team,

This post is to express a security concern regarding the recent update that mandates the Dropbox folder's location at /Users/[username]/Library/CloudStorage/Dropbox on macOS systems. While this change aligns with Apple's guidelines, it introduces a vulnerability on shared computers.

Issue:

On shared macOS devices, administrators have the ability to:

• Reset user passwords, thereby gaining access to all user files, including those in the Dropbox folder.
• Modify file permissions or utilize root access to navigate into user directories.

These capabilities mean that, despite enabling FileVault for disk encryption, an administrator can still access another user's Dropbox files.

Request:

To address this security concern, I propose the following enhancements:

1. Support for Encrypted Volumes: Allow users to store the Dropbox folder on encrypted disk images or volumes. This would add an additional layer of security, ensuring that even if an administrator accesses the user account, the Dropbox files remain protected.
2. User-Defined Folder Locations: Provide flexibility for users to choose the location of their Dropbox folder. This would enable the use of custom security measures, such as storing the folder in a more secure directory or on an external encrypted drive.

Implementing these features would significantly enhance data security for users on shared macOS systems, aligning with Dropbox's commitment to safeguarding user information.

Thank you for considering this request. I look forward to your response and any potential solutions to this concern.

Best regards,