This very much puts the onus on the user to take great care with who they trust with their documents. The Dropbox Vault owner is sent a notification that a trusted account holder has downloaded a copy of their files, but by then it is, of course, too late to do anything about it. That means, should the trusted account holder have their password stolen, someone with access to that account could download a copy of all your sensitive documents. The trusted account holder merely needs to re-enter their password.
I tested this with a colleague who doesn’t use two-factor authentication and he was able to download all the files in my Vault.
The trusted account form only asks you to enter the recipient's address once Barry Collinsįurthermore, there is no requirement for the trusted contact to enter a PIN number nor any requirement that they use additional account security measures, such as two-factor authentication.
