Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Older unlisted videos will be made private unless you opt out”

support.google.com

Post reply on HN
Print view View original

41–50 of 196 posts

Re: “Older unlisted videos will be made private unless you opt out”

#41

Post by jackson1442 »

MauranKilom wrote: post #32
jackson1442 wrote: post #25

Earlier quoted context omitted.

Did they send an email to affected accounts? There seems to be a logical reason for this (newer unlisted videos have a more secure url generator), so I’d say this is neutral at worst.

Some of my videos would be affected and I got an email from them. Seems reasonable to me. Of course, there is probably a large number of currently unlisted videos from accounts that are no longer active, which would effectively be lost after this change. Unfortunate.

It'd be interesting if Google had made this only apply to accounts that have had activity in, say, the last six months. If an account logs in and was skipped due to inactivity, it would then be appropriate to prompt them for their decision.

That, of course, requires significantly more engineering so I can see why it didn't happen.

Re: “Older unlisted videos will be made private unless you opt out”

#42

Post by quantumofalpha »

judge2020 wrote: post #15

So the reasoning makes it sound like there was potentially an exploit that made it easy to find unlisted videos? Were the video IDs deterministic perhaps?

Yes, exactly. Video ID is just a base64'ed DES-encrypted primary int64 video key from MySQL. It used to be sequentially incremented until at some point they switched to randomly generated primary keys. Any (ex-) engineer who snapped a copy of the encryption key (it used to sit right in the code for anyone to see) can enumerate all videos from YT until that moment, including unlisted - which are only protected by secrecy of that one key. If the key leaks, then also anyone in the world can. That's what they are afraid of here. Source: worked for YT.

Re: “Older unlisted videos will be made private unless you opt out”

#43

Post by app4soft »

btown wrote: post #31

A welcome move for individuals who may have embarrassing content as Unlisted links. Future politicians will thank you. But... this will hit B2B product training and product marketing libraries hard . Many companies I've seen have help pages with embedded or linked videos for features not updated in years, and many of those embeds are Unlisted videos so that they're only seen in the context of their help article, not…

> A welcome move for individuals who may have embarrassing content as Unlisted links.

All those "early access" on Patreon.

Re: “Older unlisted videos will be made private unless you opt out”

#44

Post by anfilt »

varispeed wrote: post #21
dathinab wrote: post #3

Seems reasonable tbh. even through it might "hit" some hidden and mostly forgotten gems.

Now I regret not saving at least a list of links of some of the videos :( How people who died are supposed to tick the box :/

I was thinking the same not everyone is sadly still around to make sure their content does not go basically poof.

Re: “Older unlisted videos will be made private unless you opt out”

#45

Post by jzelinskie »

llacb47 wrote: post #28
judge2020 wrote: post #20

The thing that makes this fishy is that I also received an email for my Google Workspace organization about link sharing changing for Google Drive for a security update, and the date it initially takes effect is the same day at this YouTube thing, July 23. https://support.google.com/a/answer/10685032?hl=en Could something have happened across their entire Zanzibar/ ACL infrastructure?

Could you explain what that is?

The permissions service at Google. For more details see: https://authzed.com/blog/what-is-zanzibar/

Re: “Older unlisted videos will be made private unless you opt out”

#46

Post by xxpor »

judge2020 wrote: post #20

The thing that makes this fishy is that I also received an email for my Google Workspace organization about link sharing changing for Google Drive for a security update, and the date it initially takes effect is the same day at this YouTube thing, July 23. https://support.google.com/a/answer/10685032?hl=en Could something have happened across their entire Zanzibar/ ACL infrastructure?

I completely thought the email I got for this (for my personal Google app domain) was a phishing attempt. Why couldn't they have included the text in the email rather than some generic sketchy "You have a notification" nonsense?

Re: “Older unlisted videos will be made private unless you opt out”

#47

Post by ktm8 »

quantumofalpha wrote: post #42
judge2020 wrote: post #15

So the reasoning makes it sound like there was potentially an exploit that made it easy to find unlisted videos? Were the video IDs deterministic perhaps?

Yes, exactly. Video ID is just a base64'ed DES-encrypted primary int64 video key from MySQL. It used to be sequentially incremented until at some point they switched to randomly generated primary keys. Any (ex-) engineer who snapped a copy of the encryption key (it used to sit right in the code for anyone to see) can enumerate all videos from YT until that moment, including unlisted - which are only protected by secr…

Just for curiosity, how would YT deal with ID collision ?

Edit: Before the scheme change I mean

Re: “Older unlisted videos will be made private unless you opt out”

#48

Post by [deleted] »

btown wrote: post #31

A welcome move for individuals who may have embarrassing content as Unlisted links. Future politicians will thank you. But... this will hit B2B product training and product marketing libraries hard . Many companies I've seen have help pages with embedded or linked videos for features not updated in years, and many of those embeds are Unlisted videos so that they're only seen in the context of their help article, not…

[deleted]

Re: “Older unlisted videos will be made private unless you opt out”

#49

Post by newsclues »

btown wrote: post #31

A welcome move for individuals who may have embarrassing content as Unlisted links. Future politicians will thank you. But... this will hit B2B product training and product marketing libraries hard . Many companies I've seen have help pages with embedded or linked videos for features not updated in years, and many of those embeds are Unlisted videos so that they're only seen in the context of their help article, not…

Maybe critical training materials should not be published to YouTube?

Re: “Older unlisted videos will be made private unless you opt out”

#50

Post by root_axis »

ktm8 wrote: post #47
quantumofalpha wrote: post #42

Earlier quoted context omitted.

Yes, exactly. Video ID is just a base64'ed DES-encrypted primary int64 video key from MySQL. It used to be sequentially incremented until at some point they switched to randomly generated primary keys. Any (ex-) engineer who snapped a copy of the encryption key (it used to sit right in the code for anyone to see) can enumerate all videos from YT until that moment, including unlisted - which are only protected by secr…

Just for curiosity, how would YT deal with ID collision ? Edit: Before the scheme change I mean

Try again? Just a guess.
Post reply on HN