[RachelF]

Does Dropbox not use Amazon S3 as their storage engine anyway? This should have an open API?

[mcpherrinm]

Dropbox does have an API, https://www.dropbox.com/developers but this is about reverse engineering the client which seems to use things not here -- in particular, some authentication stuff. I haven't read in depth about why that allowed them to bypass 2-factor auth though.

[jontas]

From the whitepaper (https://github.com/kholia/dedrop/blob/master/paper/accepted/...):

> We found that two-factor authentication (as used by Dropbox) only protects against unauthorized access to the Dropbox’s website. The Dropbox internal client API does not support or use two-factor authentication!

[zeckalpha]

Don't they use S3 internally? I assumed the desktop client does not access S3 directly, but that their server is middleware.