I'm surprised you can sign an executable, then modify it while preserving the validity of the signature, as I always though this is exactly what code signing is meant to prevent. Can anyone who knows more about this than me (a low bar!) explain whether this is a flaw in the signing mechanism or is actually okay?
Fascinating stuff, but was this a problem in need of a solution? Was Dropbox seeing that many issues with people running the install on their local machine? Were they able to differentiate between those who felt the install was a hassle versus those who simply opted to not install it?
I typically set my browser to clear cookies every session. Is there any provision for such a scenario? The authentication flow seems to suggest that if the browser was closed and cookies cleared, the user would not be allowed to install Dropbox.
I wonder if there are any plans to rewrite the desktop client in C++ (with some Objective-C++ on Mac), presumably using the libdropbox C++ libraries that Dropbox has been developing for the mobile apps, to get the installer size down and leverage more common code across platforms.
Honestly, I find their mobile offering really disappointing. Several times I've wanted to do things with it and not been able to, like login using only the mobile app and download some pictures I backed up for my wife, etc.. They don't seem to see the mobile app as a real, full app. This connect to desktop thing just makes it even worse. I didn't have my laptop around at the time. We've had other big issues with it involving the iPad version not being able to do things.
"...while letting us safely modify content for each binary. Our custom tool allows us to create an unverified section of the binary in a way that is compliant with the Authenticode spec."<p>sounds like Condi didn't need much time for Dropbox to build a nice new home for NSA implants.<p>quite an intriguing attack surface for mobile malware...arbitrary code of Dropbox's choosing when combined with another 0day or two? no thanks.<p>this makes me glad i dropped dropbox like a bad habit.