Your upload finished instantly. That's a privacy leak.

transcript

You upload a 100 megabyte file. It finishes instantly. Great for you. But it just told you about someone else.

Sync apps cut a file into 4 megabyte chunks. Each one gets a hash. Before sending anything, the client asks: which of these are you missing? The server answers with only the missing ones. The rest are skipped.

Now it gets tempting. Chunks are keyed by their hash. So if any user already stored a chunk, why store it again? But here's the catch. The skip itself is an answer.

Take a file you suspect another user stores. Hash it. Send no bytes. Ask the server: do you have this hash? Upload skipped? Then somebody else stores that exact file.

Dedupe across everyone skips the most uploads. And leaks who stores what. So dedupe only within one user, or one shared folder. Or make the client prove it holds the bytes before you skip.

Every skip tells the client something about what you store. A skipped upload is an answer. Only answer about the user's own files.

Full breakdown in the lecture.