“Cybercriminals will target the weakest link in an application and companies must do their upmost to help protect their users by plugging any gaps through constant testing,” said Jake Moore, cybersecurity specialist at security firm ESET. However, security experts warn users should use such features with care. The trusted account feature is intended to give family members or other confidants access to those critical files should the account holder be unavailable because of a medical emergency, for example. This very much puts the onus on the user to take great care with who they trust with their documents. The Dropbox Vault owner is sent a notification that a trusted account holder has downloaded a copy of their files, but by then it is, of course, too late to do anything about it.

That means, should the trusted account holder have their password stolen, someone with access to that account could download a copy of all your sensitive documents. The trusted account holder merely needs to re-enter their password.

I tested this with a colleague who doesn’t use two-factor authentication and he was able to download all the files in my Vault. The trusted account form only asks you to enter the recipient's address once Barry Collinsįurthermore, there is no requirement for the trusted contact to enter a PIN number nor any requirement that they use additional account security measures, such as two-factor authentication.

What is dropbox vault