Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google API keys weren't secrets, but then Gemini changed the rules

trufflesecurity.com

Post reply on HN
Print view View original

21–30 of 326 posts

Re: Google API keys weren't secrets, but then Gemini changed the rules

#21

Post by solid_fuel »

bryanrasmussen wrote: post #5
bpodgursky wrote: post #3

ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.

How do you know that this blog post was written by ChatGPT?

It feels generated to me too. It’s this:

    When you enable the Gemini API (Generative Language API) on a Google Cloud project, existing API keys in that project (including the ones sitting in public JavaScript on your website) can silently gain access to sensitive Gemini endpoints. No warning. No confirmation dialog. No email notification.
Specifically, the last bit - “No warning. No confirmation dialog. No email notification.” Immediately smells like LLM generated text to me. Punchy repetition in a set of 3.

If you scroll through tiktok or instagram you can see the same exact pattern in a lot of LLM generated descriptions.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#22

Post by cyral »

bpodgursky wrote: post #9
bryanrasmussen wrote: post #5

Earlier quoted context omitted.

How do you know that this blog post was written by ChatGPT?

> The Core Problem > What You Should Do Right Now > Bonus: Scan with TruffleHog. > TruffleHog will verify whether discovered keys are live and have Gemini access , so you'll know exactly which keys are exposed and active, not just which ones match a regular expression. I don't know exactly, but I'm sure. The cadence, the clarity, the bolding, the italics, it's all just crisp and clean structured and actionable in a w…

Yup, it was actually an interesting article but there are a few telltale parts that sound like every AI spam post on /r/webdev and similar. "No warning. No confirmation dialog. No email notification." is another. The three negatives repeated is present in so many AI generated promotional posts.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#25

Post by adenta »

louison11 wrote: post #19

This seems so… obvious? How can a company of this size, with its talent and expertise, not have standardized tests or specs preventing such a blatant flaw?

Stuff like this was proposed to be added to standard interviews, but they were too busy reversing binary trees

Re: Google API keys weren't secrets, but then Gemini changed the rules

#26

Post by larusso »

solid_fuel wrote: post #21
bryanrasmussen wrote: post #5

Earlier quoted context omitted.

How do you know that this blog post was written by ChatGPT?

It feels generated to me too. It’s this: When you enable the Gemini API (Generative Language API) on a Google Cloud project, existing API keys in that project (including the ones sitting in public JavaScript on your website) can silently gain access to sensitive Gemini endpoints. No warning. No confirmation dialog. No email notification. Specifically, the last bit - “No warning. No confirmation dialog. No email notif…

I’m not a native speaker so my level of AI recognition is already low. I find it very interesting what patters people bring up to declare it’s AI. The 3 punchline one for instance is a pattern I use while speaking. Can’t say I would write like this though.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#27

Post by bpodgursky »

cyral wrote: post #22
bpodgursky wrote: post #9

Earlier quoted context omitted.

> The Core Problem > What You Should Do Right Now > Bonus: Scan with TruffleHog. > TruffleHog will verify whether discovered keys are live and have Gemini access , so you'll know exactly which keys are exposed and active, not just which ones match a regular expression. I don't know exactly, but I'm sure. The cadence, the clarity, the bolding, the italics, it's all just crisp and clean structured and actionable in a w…

Yup, it was actually an interesting article but there are a few telltale parts that sound like every AI spam post on /r/webdev and similar. "No warning. No confirmation dialog. No email notification." is another. The three negatives repeated is present in so many AI generated promotional posts.

I don't even have a problem with the content itself, I think frankly the smell is that it's too good. It's just fascinating in the sense that it's one LLM attacking another LLM.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#28

Post by SlightlyLeftPad »

louison11 wrote: post #19

This seems so… obvious? How can a company of this size, with its talent and expertise, not have standardized tests or specs preventing such a blatant flaw?

First of all, Google is a shell of the company it used to be.

That said, I’d actually argue there’s an evolutionary explanation behind this where at a certain size, and more importantly complexity, an oversight like this becomes even more likely, not less.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#29

Post by bandrami »

the_arun wrote: post #8

Private data should not be allowed to be accessed using public keys. That is the core problem. It is not about Google API keys are secret or not.

It was intended for situations where the keyholder is a middleman between Google's API and the end user.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#30

Post by solid_fuel »

larusso wrote: post #26
solid_fuel wrote: post #21

Earlier quoted context omitted.

It feels generated to me too. It’s this: When you enable the Gemini API (Generative Language API) on a Google Cloud project, existing API keys in that project (including the ones sitting in public JavaScript on your website) can silently gain access to sensitive Gemini endpoints. No warning. No confirmation dialog. No email notification. Specifically, the last bit - “No warning. No confirmation dialog. No email notif…

I’m not a native speaker so my level of AI recognition is already low. I find it very interesting what patters people bring up to declare it’s AI. The 3 punchline one for instance is a pattern I use while speaking. Can’t say I would write like this though.

It's not so much the grouping of 3 or way it's supposed to be punchy specifically that's the problem, that is just one example of what gives the article the "LLM Generated" feeling since whatever cheap model people are using for this kind of spam has some common ticks.

I use groupings of 3 and try to make things punchy myself sometimes, especially when I'm writing something intended to sway others. I think the problem with this article is the way it feels like the perfect average of corporate writing. It's sort of like the "written by committee" feel that incredibly generic pop music often has.

When I write things, I often go back and edit and reword parts. Like the brushstrokes in an oil painting, the flow of thought varies between paragraphs and even sentences. LLMs only generate things from left to right (or vice versa in RTL languages, I presume). I think that gives LLM generated text a "smooth" texture that really stands out to anyone who reads a lot.

Post reply on HN