To download from Google Drive, you must enable third party cookies? • Hacker News Board

Re: To download from Google Drive, you must enable third party cookies?

#111

Post by rediguanayum » Tue, Jul 19, 2022, 3:05 PM UTC

jefftk wrote: post #109

coder543 wrote: post #106

Earlier quoted context omitted.

I don't fully understand why they need to use a separate domain for this at all. There is infinite URL space available on drive.google.com, even if Google just used a proxy behind the scenes to route those requests to whatever load balancer normally services googleusercontent.com, and that would solve the issue with third party cookies entirely... as well as several other issues, like potentially confusing users with…

It's not about url space or load balancing, but security. You do not want to serve user content from your primary domain: * Even if you serve it with the correct content type and no-sniff headers some browsers can be tricked into running JS, and then you have XSS. * Even in modern browsers it's defense in depth, in case you mess up your configuration or they have a bug. * If malware gets past your scanners then your…

This is correct.

Re: To download from Google Drive, you must enable third party cookies?

#112

Post by jefftk » Tue, Jul 19, 2022, 3:07 PM UTC

coder543 wrote: post #110

jefftk wrote: post #109

Earlier quoted context omitted.

It's not about url space or load balancing, but security. You do not want to serve user content from your primary domain: * Even if you serve it with the correct content type and no-sniff headers some browsers can be tricked into running JS, and then you have XSS. * Even in modern browsers it's defense in depth, in case you mess up your configuration or they have a bug. * If malware gets past your scanners then your…

I guess that’s all fair, but to be clear, I’m not proposing to host public-facing content. Only private content that can be viewed by authorized users who have the right first party cookie to allow it. Public facing content could easily be hosted on the other domain for all of the reasons you listed, and third party cookies won’t matter then. I appreciate you outlining the arguments. I know some other sites like Drop…

Content that's limited to specific users can still be used for targeted attacks, so it doesn't help very much.

Re: To download from Google Drive, you must enable third party cookies?

#113

Post by coder543 » Tue, Jul 19, 2022, 3:13 PM UTC

jefftk wrote: post #112

coder543 wrote: post #110

Earlier quoted context omitted.

I guess that’s all fair, but to be clear, I’m not proposing to host public-facing content. Only private content that can be viewed by authorized users who have the right first party cookie to allow it. Public facing content could easily be hosted on the other domain for all of the reasons you listed, and third party cookies won’t matter then. I appreciate you outlining the arguments. I know some other sites like Drop…

Content that's limited to specific users can still be used for targeted attacks, so it doesn't help very much.

It would still say “drive.google.com”, not “google.com”, and if that isn’t enough of a hint for the target, googleusercontent.com won’t be either. In fact, people have heard of Google Drive. They know that means it isn't from Google. "googleusercontent" could be "Google content intended for users" for all someone knows.

So, I disagree here. The well-known name of Google Drive as a user file sharing service is much more meaningful as a warning at a glance.

There are also mitigations that could be put in place for file sharing, like requiring the user to have accepted a file sharing request from that account before (via Google sent notification email) for a direct link to actually work. This would be a great thing to have in place regardless of domain, for defense in depth. Unsolicited links to private files arguably should not work.

Obviously people may have different opinions on this stuff.

Re: To download from Google Drive, you must enable third party cookies?

#114

Post by mrweasel » Tue, Jul 19, 2022, 3:14 PM UTC

horsawlarway wrote: post #84

workingon wrote: post #77

Earlier quoted context omitted.

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the curre…

> This is basically the poster child for a case when someone should be using 3rd party cookies

It is kinda funny that Google, among others, are the reason why we can have 3rd party cookies. Now they have a services that has a legitimate use-case and can't rely on 3rd party cookies being available and have to revert to work-around.

Re: To download from Google Drive, you must enable third party cookies?

#115

Post by xenomachina » Tue, Jul 19, 2022, 3:16 PM UTC

coder543 wrote: post #106

jefftk wrote: post #71

Earlier quoted context omitted.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

I don't fully understand why they need to use a separate domain for this at all. There is infinite URL space available on drive.google.com, even if Google just used a proxy behind the scenes to route those requests to whatever load balancer normally services googleusercontent.com, and that would solve the issue with third party cookies entirely... as well as several other issues, like potentially confusing users with…

Using a separate domain for user generated content is usually done for security reasons. For example, if a user-generated chunk of JavaScript was executed from drive.google.com, then it could potentially gain access to your drive.google.com, or maybe even *.google.com, authentication cookies. Scripts running on an unrelated domain have no such access.

This usually isn't the only thing protecting against this, and is instead used as an additional safeguard.

I believe Google's use of this practice also predates widespread support of Content Security Policy, which isn't to say that this is a useless practice, but perhaps it isn't as important as it used to be.

Re: To download from Google Drive, you must enable third party cookies?

#116

Post by coder543 » Tue, Jul 19, 2022, 3:20 PM UTC

xenomachina wrote: post #115

coder543 wrote: post #106

Earlier quoted context omitted.

I don't fully understand why they need to use a separate domain for this at all. There is infinite URL space available on drive.google.com, even if Google just used a proxy behind the scenes to route those requests to whatever load balancer normally services googleusercontent.com, and that would solve the issue with third party cookies entirely... as well as several other issues, like potentially confusing users with…

Using a separate domain for user generated content is usually done for security reasons. For example, if a user-generated chunk of JavaScript was executed from drive.google.com, then it could potentially gain access to your drive.google.com, or maybe even *.google.com, authentication cookies. Scripts running on an unrelated domain have no such access. This usually isn't the only thing protecting against this, and is…

> I believe Google's use of this practice also predates widespread support of Content Security Policy, which isn't to say that this is a useless practice, but perhaps it isn't as important as it used to be.

I agree completely.

Re: To download from Google Drive, you must enable third party cookies?

#117

Post by mrweasel » Tue, Jul 19, 2022, 3:21 PM UTC

sneak wrote: post #19

giancarlostoro wrote: post #17

Earlier quoted context omitted.

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

Forget the monopoly part, the reference to IE6, all that stuff. Let's say we don't care about that. What happens when the Chrome rendering engine has a security bug, a big one, a zero-day? That's the issue we had with OpenSSL, suddenly 90% of the Internet er vulnerable and there are no alternatives until Google fixes the bug.

Given the complexity and feature set of a modern rendering engine I don't think it's to fare fetched. I like the entire Internet not being vulnerable all at once.

Re: To download from Google Drive, you must enable third party cookies?

#118

Post by hedora » Tue, Jul 19, 2022, 3:24 PM UTC

shadowgovt wrote: post #61

squidbeak wrote: post #55

Earlier quoted context omitted.

You've forgotten what it was like at the turn of the century. It took a long while for us to break the previous monoculture and clear the way for the innovation we've enjoyed since.

The innovation we've enjoyed since was mostly caused by Google getting tired of waiting for either Microsoft or Mozilla to improve on the browser paradigm and footing the bill to roll their own.

History doesn't really linenup with that:

Web 2.0 was based on some IE extensions that were introduced when Firefox was the viable other game in town.

Concretely, Google Maps (the poster child for AJAX) launched in 2005, and Chrome launched in 2008.

Re: To download from Google Drive, you must enable third party cookies?

#119

Post by jefftk » Tue, Jul 19, 2022, 3:24 PM UTC

coder543 wrote: post #113

jefftk wrote: post #112

Earlier quoted context omitted.

Content that's limited to specific users can still be used for targeted attacks, so it doesn't help very much.

It would still say “drive.google.com”, not “google.com”, and if that isn’t enough of a hint for the target, googleusercontent.com won’t be either. In fact, people have heard of Google Drive. They know that means it isn't from Google. "googleusercontent" could be "Google content intended for users" for all someone knows. So, I disagree here. The well-known name of Google Drive as a user file sharing service is much mo…

> There are also mitigations that could be put in place for file sharing, like requiring the user to have accepted a file sharing request from that account before (via Google sent notification email) for a direct link to actually work.

That sounds pretty annoying? I upload something, give access to coder543, and ping you a link in Slack or whatever tool we use. But you can't open it until you go into your email and click through?

Re: To download from Google Drive, you must enable third party cookies?

#120

Post by coder543 » Tue, Jul 19, 2022, 3:28 PM UTC

jefftk wrote: post #119

coder543 wrote: post #113

Earlier quoted context omitted.

It would still say “drive.google.com”, not “google.com”, and if that isn’t enough of a hint for the target, googleusercontent.com won’t be either. In fact, people have heard of Google Drive. They know that means it isn't from Google. "googleusercontent" could be "Google content intended for users" for all someone knows. So, I disagree here. The well-known name of Google Drive as a user file sharing service is much mo…

> There are also mitigations that could be put in place for file sharing, like requiring the user to have accepted a file sharing request from that account before (via Google sent notification email) for a direct link to actually work. That sounds pretty annoying? I upload something, give access to coder543, and ping you a link in Slack or whatever tool we use. But you can't open it until you go into your email and c…

Maybe my phrasing was awkward, but I said you would only have to do this once for a given account. So, if I've never accepted a share from you before, your links won't work. When you share something with me for the first time, I would have to accept it via a Google-sent email containing a link that only Google knows (not something that can be sent via slack), and then all your future share links would work for me on slack. The error page denying access could even indicate that the user should check their email for additional verification.

You can think of it as the equivalent of a friend request. "This person tried to share a file with you. Do you know this person? Are you sure you want to receive files from them?"

This is not some outlandish solution. This should not be "pretty annoying". Based on my own experience, most people would go months or years between seeing these emails, since people tend to share files with (and receive files from) the same people over and over.

Moreover, in a work context, you would probably be sharing links to files that are on a shared google drive that I have equal access to already, so that would not require additional verification. It's not an unsolicited link to someone else's Google Drive... it's a link to a drive that I already have read/write access to.