Live data from Hacker News

Google API keys weren't secrets, but then Gemini changed the rules

trufflesecurity.com

221–230 of 326 posts

Re: Google API keys weren't secrets, but then Gemini changed the rules

#221

Earlier quoted context omitted.

[flagged]

I did. Specifically the part about "When you enable the Gemini API". This doesn't take into account that people may have had years old forgotten about other services they use.

Either way it requires action, there is nothing to presume about that

Re: Google API keys weren't secrets, but then Gemini changed the rules

#222
post #120

Earlier quoted context omitted.

> First of all, Google is a shell of the company it used to be. Isn't that squarely at odds with Google's supposed AI prowess? Is the rot really so severe that their advances in AI (including things they've yet to make public) are insufficient to overcome it? Or are the capabilities of Gemini and AI systems in general being oversold?

> Or are the capabilities of Gemini and AI systems in general being oversold? I pretty much sure that if anyone asked Gemini "Is it good idea to retroactively opt-in new services into for old API keys?" it would suggest it's bad idea. Problem is that no one asked.

I've learned repeatedly that LLMs are very susceptible to helpfully giving you the wrong answer when you're asking the wrong question, or asking it in the wrong way.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#223
post #196

Earlier quoted context omitted.

I should have said if you recover it in your damages , which every competent attorney will push for.

Legal fees are not something you are usually legally entitled to. Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it.

> Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it.

It is not illegal to include legal fees in damages.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#224

Earlier quoted context omitted.

I did. Specifically the part about "When you enable the Gemini API". This doesn't take into account that people may have had years old forgotten about other services they use.

Either way it requires action, there is nothing to presume about that

Fair enough. It's a reasonable expectation of someone that enabled Google maps 15 years ago that enables Gemini 6 months not to understand the fundamentals of how Google treats their keys. If it wasn't explained on the enabling Gemini screen, what do you expect the user to do.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#225

Earlier quoted context omitted.

Either way it requires action, there is nothing to presume about that

Fair enough. It's a reasonable expectation of someone that enabled Google maps 15 years ago that enables Gemini 6 months not to understand the fundamentals of how Google treats their keys. If it wasn't explained on the enabling Gemini screen, what do you expect the user to do.

Totally agreed. But it clearly requires user action. I have some old projects that only use Google Maps for websites and that wouldn't magically be impacted. Google needs to do better though

Re: Google API keys weren't secrets, but then Gemini changed the rules

#226
post #184

Many people wanted to be able to set a spending limit on google cloud account for many years but they were unable to implement anything, always suggesting a workaround by hosting a Cloud Run function which would remove billing from a project via API https://docs.cloud.google.com/billing/docs/how-to/disable-bi...

As someone who is new to the whole google cloud ecosystem, the amount of dark patterns they employ are absolutely shocking. Just off the top of my head:

1. You never know how much a single API request will cost or did cost for the gemini api

2. It takes anywhere between 12-24 hours to tell you how much they will charge you for past aggregate requests

3. No simple way to set limits on payment anywhere in google cloud

4. Either they are charging for the batch api before even returning a result, or their "minimal" thinking mode is burning through 15k tokens for a simple image description task with 5. Incomplete batch requests can't be retrieved if they expire, despite being charged.

6. A truly labyrinthine ui experience that makes modern gacha game developers blush

All I have learned here is to never, ever use a google product.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#227
post #196

Earlier quoted context omitted.

I should have said if you recover it in your damages , which every competent attorney will push for.

Legal fees are not something you are usually legally entitled to. Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it.

Under what statute is it illegal to request legal fees?

Re: Google API keys weren't secrets, but then Gemini changed the rules

#228
post #138
post #83

In Google AI Studio, Google documentation encourages to deploy vibecoded apps with an open proxy that allow equivalent AI billing abuse - giving the impression that the API key were secure because it is behind a proxy. Even an app with 0 AI features exposes dollars-per-query video models unless the key is manually scoped. Vulnerable apps (all apps deployed from AI Studio) are easily found by searching Google, Twitter…

[flagged]

It’s possibly civil, but I don’t see how this type of negligence would be breaking a law. If it was illegal, a massive number of independent consultants would be serving prison sentences. I’m not sure how that makes anything better though I guess a lot of people think rage is fun.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#229
post #184

Many people wanted to be able to set a spending limit on google cloud account for many years but they were unable to implement anything, always suggesting a workaround by hosting a Cloud Run function which would remove billing from a project via API https://docs.cloud.google.com/billing/docs/how-to/disable-bi...

At scale, distributed API routing shouldn't call accounting transactions, that expands the availability risk surface and adds latency to all valid requests for no reason (other than helping the minority of companies/users who want their product to stop working when it is popular). Distributed “shared nothing” API handling should make usage available to accounting, and the API handling orchestrator should have a hook…

That is a nice excuse, do you work at Google? :) I get the idea of not slowing down requests or risking availability, but don’t tell me a company as big as Google can’t design an asynchronous accounting system robust enough to handle this. We’re not talking about penny-perfect precision - blocking at 110% or even 150% of the set cap would be enough. Right now, though, there’s nothing to prevent a $5k, 20k or even higher bill surprise due to API key leaks, misuse or wrong configuration. To me, this is unacceptable and one of the reason I try to avoid using gcloud (the other one is unbearably slow gogole cloud console "webapp").
Post reply on HN