Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

news.ycombinator.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#21

Post by drw85 »

lowkj wrote: post #9
tptacek wrote: post #8

Earlier quoted context omitted.

Google isn't charging you anything in this instance; they're requiring you to get an assessment from a third party, and while $75k is way out of line for a straightforward assessment of a simple CRUD-type app, $15k is actually on the low end for that kind of work.

Understood, however from our cash flow perspective, Google is “charging” us this amount in order to play. We have no alternatives, we cannot find another vendor, and at the end of the day have to pay a minimum of $15k to compete with them. It makes no difference who gets the money, obviously that amount of money means nothing to Google.

You're neither competing with them nor are they charging you money. They're wanting an assessment from a trusted company, to ensure that you don't mess around on their service. Yes, it costs money, but from their standpoint it's simply an insurance against exploitation on their service/platform.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#22

Post by aspantel »

IncludeSecurity wrote: post #16
aspantel wrote: post #2

When we asked to use another security company for the assessment Google responded: "We understand your concern but you will have to request a security assessment from one of the following independent third-party assessors: Leviathan Security, Bishop Fox".

Interesting! I have some ideas for options here if you'd like to chat offline to see if I can help you here hit us up. https://includesecurity.com/#contact Context: I work in this space and actively work on programs such as these.

The problem is that Google wants to see reviews from one of those companies. We're communicating with them regarding this more ... Because this is just a major shake down which will put small dev. shops out of business.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#23

Post by IncludeSecurity »

aspantel wrote: post #22
IncludeSecurity wrote: post #16

Earlier quoted context omitted.

Interesting! I have some ideas for options here if you'd like to chat offline to see if I can help you here hit us up. https://includesecurity.com/#contact Context: I work in this space and actively work on programs such as these.

The problem is that Google wants to see reviews from one of those companies. We're communicating with them regarding this more ... Because this is just a major shake down which will put small dev. shops out of business.

Yes I understand the problem, we've seen it before. I still have ideas that could help you if you'd like to communicate off HN, I'm happy to share.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#24

Post by zenexer »

philipkiely wrote: post #18

Related: I am going through Google's OAuth verification for a simple "sign up with google" function plus a non-restricted scope access. They say that the application is approved, the console has a green check mark and says "published" and I got an email saying that the application has been approved. However, whenever a user actually tries to sign up, it says that the app is not verified. So I can't submit anything fo…

I’m going off very little info here, but this is almost always not Google’s fault. Double-check everything and try a prebuilt application that’s known to work with those scopes.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#25

Post by aspantel »

IncludeSecurity wrote: post #23
aspantel wrote: post #22

Earlier quoted context omitted.

The problem is that Google wants to see reviews from one of those companies. We're communicating with them regarding this more ... Because this is just a major shake down which will put small dev. shops out of business.

Yes I understand the problem, we've seen it before. I still have ideas that could help you if you'd like to communicate off HN, I'm happy to share.

Got it. Let me see what Google responds to our last inquiry, then I'll contact.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#26

Post by aspantel »

IncludeSecurity wrote: post #23
aspantel wrote: post #22

Earlier quoted context omitted.

The problem is that Google wants to see reviews from one of those companies. We're communicating with them regarding this more ... Because this is just a major shake down which will put small dev. shops out of business.

Yes I understand the problem, we've seen it before. I still have ideas that could help you if you'd like to communicate off HN, I'm happy to share.

Google completely ignores our complaints about forcing app developers to use just those two firms so any dev. shop using Gmail API (or IMAP over OAuth2) should be prepared to pay >$15k! That is going to drive many small businesses out of business.

Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?

#27

Post by aspantel »

aspantel wrote: post #2

When we asked to use another security company for the assessment Google responded: "We understand your concern but you will have to request a security assessment from one of the following independent third-party assessors: Leviathan Security, Bishop Fox".

Here is the problem explained https://www.theregister.co.uk/2019/02/11/google_gmail_develo...
Post reply on HN