In response to this summary of FTC complaint, I'm just not sure how Dropbox have violated their agreement with the customer.
One of the strongly emphasised features of Dropbox is deduplication (i.e. so you won't need to re-upload massive files if someone else already has), and if you are particularly security conscious, presumably you would have made the effort to read about how Dropbox stores their files and considered whether this method was adequately secure for you prior to use.
I'm assuming the single key is related to deduplication, and although I don't understand why you couldn't simply store a key per user, I'm not even sure whether that would be more or less secure given that insiders with access to the encrypted files can probably also get access to the database of encryption keys.
As far as some select employees having access to your files, surely this is to be expected - the alternative is they get sued/charged by the authorities and are forced to implement an even more compromising solution than a couple of Dropbox employees having access (e.g. a backdoor for the RIAA).
I agree that it's hard to argue that people were deceived, especially considering that I've chosen not to use Dropbox from the start beacause they only used one key for everyone, because employees could access my files, and so on.
If I (with no degree, no formal training in information security, just my wits) knew, why didn't everyone? I'm tempted to assume "because they didn't care to read anything more than the Dropbox marketing blurbs that say 'secure'".
That said, select employees having access to your files may be expected (as it's the most common practice in consumer backup and file hosting solutions), but it's not necessary.
I use rsync.net for my backups because I can generate a key and use it to encrypt my data without sharing that key with anyone else. Even rsync.net's employees can't read my stuff. (Please note that this is a different type of service than Dropbox: because all my data is encrypted I can't just click to share it with others.)
(I don't have any affiliation with Dropbox or rsync.net. I'm just a consumer who chose one over the other.)
One of the strongly emphasised features of Dropbox is deduplication (i.e. so you won't need to re-upload massive files if someone else already has), and if you are particularly security conscious, presumably you would have made the effort to read about how Dropbox stores their files and considered whether this method was adequately secure for you prior to use.
I'm assuming the single key is related to deduplication, and although I don't understand why you couldn't simply store a key per user, I'm not even sure whether that would be more or less secure given that insiders with access to the encrypted files can probably also get access to the database of encryption keys.
As far as some select employees having access to your files, surely this is to be expected - the alternative is they get sued/charged by the authorities and are forced to implement an even more compromising solution than a couple of Dropbox employees having access (e.g. a backdoor for the RIAA).