Dropbox does have an API, https://www.dropbox.com/developers but this is about reverse engineering the client which seems to use things not here -- in particular, some authentication stuff. I haven't read in depth about why that allowed them to bypass 2-factor auth though.
We found that two-factor authentication (as used by Dropbox) only protects against unauthorized access to the Dropbox’s website. The Dropbox internal client API does not support or use two-factor authentication!
Comments
Does Dropbox not use Amazon S3 as their storage engine anyway? This should have an open API?
Dropbox does have an API, https://www.dropbox.com/developers but this is about reverse engineering the client which seems to use things not here -- in particular, some authentication stuff. I haven't read in depth about why that allowed them to bypass 2-factor auth though.
From the whitepaper (https://github.com/kholia/dedrop/blob/master/paper/accepted/...):
Don't they use S3 internally? I assumed the desktop client does not access S3 directly, but that their server is middleware.