Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Collections, a fast multiple-account Google Docs client for Mac

beta.collections.me

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#51

Post by tonyx »

anemitz wrote: post #42
tonyx wrote: post #41

Earlier quoted context omitted.

Hi thomas-st, thanks a lot for bring this up. we just fixed the issue and changed credentials on the server as well. All transmission also happen securely through HTTPS and contents are only stored on Google's server, not ours.

Since you store the Google auth_token couldn't anyone with access to the database also gain access to sessions?

We've turned off debug mode and reset our database credentials. We are looking through the database server access log right now and going to make sure that 1) all connections were made from our own servers and 2) users in the timeframe affected will be notified of the issue and guided to resolve it as soon as possible

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#52

Post by tonyx »

xb95 wrote: post #46

Hi -- I suggest you not use this app right now. It is currently throwing up debug pages that include information that allows someone to connect to Postgres and dump the database containing information about your documents. App developers -- please update your Heroku settings and/or turn this off immediately. You are exposing confidential company information to the wild. Thanks.

Hi xb95, thanks for alerting us to the issue we've turned off debug mode and reset our database credentials. We are looking through the database server access log right now and going to make sure that 1) all connections were made from our own servers and 2) users in the timeframe affected will be notified of the issue access token revoked immediately.

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#53

Post by JoelMcCracken »

jordanlee wrote: post #16
mratzloff wrote: post #14

Earlier quoted context omitted.

He should use this exact phrase on the website. Sarcastic marketing FTW.

I won't pretend I'm not tempted.

A few years from now, you'll be bought by microsoft to replace Office.

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#54

Post by tonyx »

xb95 wrote: post #50
tonyx wrote: post #41

Earlier quoted context omitted.

Hi thomas-st, thanks a lot for bring this up. we just fixed the issue and changed credentials on the server as well. All transmission also happen securely through HTTPS and contents are only stored on Google's server, not ours.

Actually, your Postgres credentials still work. I am currently able to connect to the database and I can still view people in the role I grabbed. I'm not sure how to validate that this is still timely, though... oh, I created a table: public | hacker_news_1342216769 | table | ruwdncbzdkulsh With the current timestamp. So, if you changed anything, it hasn't actually taken effect in the part that matters -- the exposed…

thanks xb95, it took a minute to take effect, but issue is now fixed.

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#55

Post by chad_oliver »

_mayo wrote: post #44
jordanlee wrote: post #17

Earlier quoted context omitted.

Thanks! There certainly are, but not for a little while. Which would you prefer we support first?

Personally, I would love a native Linux version. Especially since there's no official Google Drive client currently available for Linux.

I second that.

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#56

Post by [deleted] »

xb95 wrote: post #50
tonyx wrote: post #41

Earlier quoted context omitted.

Hi thomas-st, thanks a lot for bring this up. we just fixed the issue and changed credentials on the server as well. All transmission also happen securely through HTTPS and contents are only stored on Google's server, not ours.

Actually, your Postgres credentials still work. I am currently able to connect to the database and I can still view people in the role I grabbed. I'm not sure how to validate that this is still timely, though... oh, I created a table: public | hacker_news_1342216769 | table | ruwdncbzdkulsh With the current timestamp. So, if you changed anything, it hasn't actually taken effect in the part that matters -- the exposed…

[deleted]

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#57

Post by xb95 »

tonyx wrote: post #54
xb95 wrote: post #50

Earlier quoted context omitted.

Actually, your Postgres credentials still work. I am currently able to connect to the database and I can still view people in the role I grabbed. I'm not sure how to validate that this is still timely, though... oh, I created a table: public | hacker_news_1342216769 | table | ruwdncbzdkulsh With the current timestamp. So, if you changed anything, it hasn't actually taken effect in the part that matters -- the exposed…

thanks xb95, it took a minute to take effect, but issue is now fixed.

As of right now, 3:16 PM PDT, I can still connect to (one of) your Postgres databases.

    # psql --host=ec2-23-21-85-231.compute-1.amazonaws.com --port=5432 -U ruwdncbzdkulsh dc6jnvg2ce8qim
    Password for user ruwdncbzdkulsh: 
    psql (9.1.4)
    SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)
    Type "help" for help.
    
    dc6jnvg2ce8qim=> SELECT NOW();
                  now              
    -------------------------------
     2012-07-13 22:17:51.821052+00
    (1 row)

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#58

Post by drivebyacct2 »

mukaiji wrote: post #43
nestlequ1k wrote: post #40

Earlier quoted context omitted.

I think they are mimicking the Google Login page and just saving your username/password. Seems damn fishy to me.

no. these guys are legit. they work in our sandhill office. They're not out to steal your login credentials.

If they're legit, why are they not using oAuth?

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#59

Post by bdittmer »

natrius wrote: post #48
bdittmer wrote: post #32

Kind of confused by this heroku error message I received? Are you storing my gmail credentials on heroku? When I tried again I have a google /looking/ login screen? http://cl.ly/1p0M0o2t0H1E3Z1h3i0n

I haven't used this so I'm not sure what's going on, but I believe OAuth involves a redirect back to servers controlled by the third party to actually do something with the authentication token. This doesn't strike me as necessarily fishy.

I guess I don't understand why they even need to store anything on their servers?

Re: Show HN: Collections, a fast multiple-account Google Docs client for Mac

#60

Post by anemitz »

tonyx wrote: post #51
anemitz wrote: post #42

Earlier quoted context omitted.

Since you store the Google auth_token couldn't anyone with access to the database also gain access to sessions?

We've turned off debug mode and reset our database credentials. We are looking through the database server access log right now and going to make sure that 1) all connections were made from our own servers and 2) users in the timeframe affected will be notified of the issue and guided to resolve it as soon as possible

It's also good practice to disallow all public traffic to your db instances on your firewall. AWS's security groups make this really easy to manage.
Post reply on HN