Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

21–30 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#21

Post by 827a »

I said this when this finding was originally posted and I'll say it again: This is by far the worst security incident Google has ever had, and that's why they aren't publicly or loudly responding to it. It's deeply embarrassing. They can't fix it without breaking customer workflows. They really, really want it to just go away and six months from now they'll complete their warning period to their enterprise contracts and then they can turn off this automated grant. Until then they want as few people to know about it as possible, and that means if you aren't on anyone's big & important customer list internally, and you missed the single 40px blurb they put on a buried developer documentation site, you're vulnerable and this will happen to you.

Disgusting behavior.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#22

Post by eru »

100ms wrote: post #14
trick-or-treat wrote: post #8

Earlier quoted context omitted.

Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.

Implementing this in any meaningful manner quickly begins to look like every read becoming a globally synchronised write. Of course it doesn't have to be perfect, but even approximating perfection doesn't look much different. Also, can you imagine the kind of downtimes and complaints that would inevitably originate from a fully synchronous billing architecture?

> Of course it doesn't have to be perfect, but even approximating perfection doesn't look much different.

It's pretty easy to get right, if the provider allows you to go (slightly) negative before cutting you off.

> Also, can you imagine the kind of downtimes and complaints that would inevitably originate from a fully synchronous billing architecture?

Doesn't need to fully synchronous.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#23

Post by embedding-shape »

luanmuniz wrote: post #17

Unfortunately, yet just another story like this. One of these unexpected usage charges in the thousands appears every month, and with the same automatic denied too. This is one of the reasons I just stopped using these kinds of pay-per-usage cloud services long ago. At best, I still use services that have hard-bounded usage limits, like EC2 from AWS, where one instance can never go beyond 24h/day usage and is always…

> At best, I still use services that have hard-bounded usage limits, like EC2 from AWS, where one instance can never go beyond 24h/day usage and is always capped, with shutdowns when exceeded, and limited credit cards, too.

Is this possible on AWS today? I'm the same way, if I cannot set a hard-limit for the billing so I can know for a fact how much it'll maximum cost in a month, I'm not interested in using that service for anything. Which is one of the top reasons I've stayed clear of AWS, they used to have only billing-alerts, but you couldn't actually set limits, guess one step forward that they've finally implemented that now.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#24

Post by microtonal »

freedomben wrote: post #12
trick-or-treat wrote: post #8

Earlier quoted context omitted.

Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.

Prepaid only is a fantastic idea, until your site goes (desirably) viral and then gets shut off right as traffic is picking up, or you grow steadily and forget to increase your deposit amount and suddenly production is down. Billing alerts are a much better solution IMHO.

You can also have both, a cap and one or more billing alert levels below it. Some providers do this (e.g. IIRC Backblaze B2).

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#25

Post by voidUpdate »

patcon wrote: post #2

That's fucking bonkers that nothing in the system could see this as unusual and worthy of throttling. The embarrassment of this -- that a company LITERALLY SELLING machine learning services and expertise -- cannot spot such a thing... This should have led them to deal with this internally and refund it. Just... Wow Google.

The company selling machine learning services would probably love a €54k bonus

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#26

Post by trick-or-treat »

freedomben wrote: post #12
trick-or-treat wrote: post #8

Earlier quoted context omitted.

Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.

Prepaid only is a fantastic idea, until your site goes (desirably) viral and then gets shut off right as traffic is picking up, or you grow steadily and forget to increase your deposit amount and suddenly production is down. Billing alerts are a much better solution IMHO.

No you big dummy, that is especially when you want to limit your liability, lol.

Because these days it will be all worthless bot traffic.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#27

Post by embedding-shape »

drtz wrote: post #11

> Are there recommended safeguards beyond ... moving calls server-side? This implies the API calls originated in the client, suggesting the client may have had they API key.

Yeah, the amount of people creating, running and maintaining websites yet don't understand how websites actually work in practice is very high and seems we haven't even come close to the ceiling yet.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#28

Post by p2detar »

I read the following [0] and immediately went to my firebase project to downgrade my plan. This is horrific.

> Yes, I’m looking at a bill of $6,909 for calls to GenerativeLanguage.GenerateContent over about a month, none of which I made. I had quickly created an API key during a live Google training session. I never shared it with anyone and it’s not pushed to any public (or private) repo or website.

0 - https://discuss.ai.google.dev/t/unexpected-gemini-api-billin...

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#29

Post by 100ms »

827a wrote: post #21

I said this when this finding was originally posted and I'll say it again: This is by far the worst security incident Google has ever had, and that's why they aren't publicly or loudly responding to it. It's deeply embarrassing. They can't fix it without breaking customer workflows. They really, really want it to just go away and six months from now they'll complete their warning period to their enterprise contracts…

This is only a little billing leakage, Operation Aurora in 2009 was 100x worse

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#30

Post by freedomben »

microtonal wrote: post #24
freedomben wrote: post #12

Earlier quoted context omitted.

Prepaid only is a fantastic idea, until your site goes (desirably) viral and then gets shut off right as traffic is picking up, or you grow steadily and forget to increase your deposit amount and suddenly production is down. Billing alerts are a much better solution IMHO.

You can also have both, a cap and one or more billing alert levels below it. Some providers do this (e.g. IIRC Backblaze B2).

Yes in reality, and ideally, you can have both, but GP specifically said "Prepaid only" implying you can't have both (which is what I replied to)
Post reply on HN