Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Drive Found Leaking Private Data

collaboristablog.com

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Google Drive Found Leaking Private Data

#11

Post by onion2k »

travisp wrote: post #4
onion2k wrote: post #3

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…

I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download". Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.

My bank account has 2 factor authentication for that very reason.

Re: Google Drive Found Leaking Private Data

#13

Post by sp332 »

onion2k wrote: post #11
travisp wrote: post #4

Earlier quoted context omitted.

I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download". Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.

My bank account has 2 factor authentication for that very reason.

If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft

Re: Google Drive Found Leaking Private Data

#15

Post by aiiane »

sp332 wrote: post #14

How does the fix work? Does it prevent the browser from sending the referrer URL? Or maybe load all documents from the same URL with the document ID in a POST request instead or GET?

Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.

Re: Google Drive Found Leaking Private Data

#16

Post by freehunter »

Pxtl wrote: post #8
onion2k wrote: post #3

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…

Yes, but it's reasonable to assume that if I keep a URL secret and it's a very long and complex URL, that nobody will be able to guess it and find the document. I mean after all, we assume that's true for passwords.

But we're more accepting of someone crawling our site trying random URLs than we are of people trying hundreds of passwords.

Re: Google Drive Found Leaking Private Data

#18

Post by lazersharks29 »

timothya wrote: post #10
lazersharks29 wrote: post #6

> "The security hole, which has now been patched by Google" This has only been fixed for new links. All existing links are still vulnerable. From Google's Blog: >"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."

To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore. The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link…

That's still pretty bad, there could be millions of leaked document URL's in the logs of severs all over the internet and users haven't been notified.

It looks like Microsoft Onedrive did a similar thing too:

https://blog.onedrive.com/update-for-shared-links/ >"We chose not to disable all previously shared links, because the change only applies to a small fraction of shared files. If customers disable and then re-share a document, this will prevent further access to a document that might have been accessed."

Re: Google Drive Found Leaking Private Data

#19

Post by eli »

nly wrote: post #12

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

Becomes less and less of an issue as sites switch to HTTPS though, right?
Post reply on HN