Google Drive Found Leaking Private Data
collaboristablog.com
Google Drive Found Leaking Private Data
1–10 of 78 posts
Re: Google Drive Found Leaking Private Data
#2I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL.
Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"
Re: Google Drive Found Leaking Private Data
#3That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the document, there's always the possibility that someone could accidentally send a link to the file to someone, or that someone could shoulder surf it, or even guess it is if it's simple enough.
Re: Google Drive Found Leaking Private Data
#4That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…
I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download".
Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.
Re: Google Drive Found Leaking Private Data
#5That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…
[deleted]
Re: Google Drive Found Leaking Private Data
#6> "The security hole, which has now been patched by Google"
This has only been fixed for new links. All existing links are still vulnerable.
From Google's Blog:
>"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."
Re: Google Drive Found Leaking Private Data
#7That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…
> there's always the possibility that someone could accidentally send a link to the file to someone
I think that would be implied when the setting says anyone with the link.
It would be the same if I attached the document to a email, someone could still forward the email.
Re: Google Drive Found Leaking Private Data
#8That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…
Yes, but it's reasonable to assume that if I keep a URL secret and it's a very long and complex URL, that nobody will be able to guess it and find the document.
I mean after all, we assume that's true for passwords.
Re: Google Drive Found Leaking Private Data
#9Google is correct to say this is a relatively obscure issue, and a relatively small increment in loss of security. Who would consider sharing a Drive link to be "secure" by any definition of the word? It can leak all over the place by numerous means. For starters, and email recipient of the link might be using an unencrypted connection for downloading the link over wifi.
Re: Google Drive Found Leaking Private Data
#10> "The security hole, which has now been patched by Google" This has only been fixed for new links. All existing links are still vulnerable. From Google's Blog: >"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."
To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore.
The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link was already leaked (and unfortunately, they can't exactly fix that). So if you have an old document, it's not vulnerable anymore, but it may at one time have been vulnerable so you might want to update it to have a new link (following the instructions in the Google blog post).