As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way to encrypt that password in a way that other applications can't read it.
As a result some security aware application ask the user every time the run for a password to avoid storing the password.
I could imagine a system where the OS has a safe area that encrypted with the password that the user uses to login to it's user account and that configured in a way that only the dropbox.exe
can access. The dropbox.exe
can identified via the path where it lies on the disk and a hash. When Dropbox updates itself it would have to give a notice to the OS to calculate a new hash.
This not only goes for Apps like Dropbox but also for Apps like KeePass that store lots of passwords. It seems to me that even a malware that can read the whole disk and capture keys via a keylogger couldn't steal passwords in a setup like this, provided the keylogger isn't active when the user signs into his user account.
Is there an error somewhere in my thinking?