Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#11

Post by tptacek »

lowkj wrote: post #9
tptacek wrote: post #8

Earlier quoted context omitted.

Google isn't charging you anything in this instance; they're requiring you to get an assessment from a third party, and while $75k is way out of line for a straightforward assessment of a simple CRUD-type app, $15k is actually on the low end for that kind of work.

Understood, however from our cash flow perspective, Google is “charging” us this amount in order to play. We have no alternatives, we cannot find another vendor, and at the end of the day have to pay a minimum of $15k to compete with them. It makes no difference who gets the money, obviously that amount of money means nothing to Google.

They're paying a lot more than $15k on security. Your money isn't going to them; it's going to a reputable assessment firm. I don't see the unfairness.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#12

Post by xfitm3 »

Yes, and it's about time. The reality is that email is a huge attack vector for corporations and it's not practical for Google to bear the burden of review as part of their ecosystem. It was tested and failed.

They've only approved two vendors, blargh. More will come in time. Be patient, or raise money.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#14

Post by IncludeSecurity »

aSockPuppeteer wrote: post #5

It appears to be a CYA move by google. A penetration test, clear detailed information about usage of user data, and it is done by separate contractors. I would hope they allow more contractors in the future.

Yep this is a common move a lot of companies are doing for their biz partners and customers are requiring these sorts of tests be done before getting final procurement sign-off.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#15

Post by IncludeSecurity »

tptacek wrote: post #7

For what it's worth, Leviathan and Bishop Fox are both strong firms.

Agree 100% tptacek. Though I would suggest that opening up vetting to add new firms and the resulting competition would only improve the situation for partners in terms of pricing, scheduling, process, etc.

Obviously we're a competing firm to those, so bias warning :), but I think it's a sound principal that would help the market.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#16

Post by IncludeSecurity »

aspantel wrote: post #2

When we asked to use another security company for the assessment Google responded: "We understand your concern but you will have to request a security assessment from one of the following independent third-party assessors: Leviathan Security, Bishop Fox".

Interesting! I have some ideas for options here if you'd like to chat offline to see if I can help you here hit us up. https://includesecurity.com/#contact

Context: I work in this space and actively work on programs such as these.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#18

Post by philipkiely »

Related: I am going through Google's OAuth verification for a simple "sign up with google" function plus a non-restricted scope access. They say that the application is approved, the console has a green check mark and says "published" and I got an email saying that the application has been approved.

However, whenever a user actually tries to sign up, it says that the app is not verified. So I can't submit anything for review, because everything has been reviewed and approved, but it still doesn't work.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#19

Post by prkvs »

It's an optional step[1] if you list your app as a G Suite marketplace app with domain only install. Of course, it makes sense if your app targets only G Suite customers and not general Gmail customers. It also limits the market reach.

[1] https://developers.google.com/gsuite/marketplace/security-as...

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#20

Post by relaunched »

It's very common for developers to mess up authentication. It requires a fundamental understanding of protocols. What makes it worse is that an incorrectly implemented protocol doesn't break the integration, it just breaks the security benefits.

A pen test mitigates that risk.

Post reply on HN