Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Drive Found Leaking Private Data

collaboristablog.com

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Google Drive Found Leaking Private Data

#21

Post by ak217 »

sp332 wrote: post #13
onion2k wrote: post #11

Earlier quoted context omitted.

My bank account has 2 factor authentication for that very reason.

If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft

What does that have to do with anything? If you issue fraudulent demand drafts, the bank will trace the destination account and send lawyers after you. If you trace referrers and open the origin URL, it's doubtful whether anyone will trace it or have legal recourse against you.

Re: Google Drive Found Leaking Private Data

#22

Post by f- »

timothya wrote: post #10
lazersharks29 wrote: post #6

> "The security hole, which has now been patched by Google" This has only been fixed for new links. All existing links are still vulnerable. From Google's Blog: >"Today’s update to Drive takes extra precaution by ensuring that newly shared documents with hyperlinks to third-party HTTPS websites will not inadvertently relay the original document’s URL."

To clarify, I think what they mean is that it's possible that those old links have already been compromised, even though none of the documents (new or old) are vulnerable anymore. The bug has been patched so that any document with the "anyone with the link" permission will no longer leak its location in the referrer when someone clicks an HTTPS link in it. But it's possible that that happened in the past and the link…

I helped draft the original blog post :-) To clarify a bit more and help folks evaluate their individual risk, it's worth noting that the impact is limited to a fairly specific scenario.

In essence, you needed to have a non-native document format uploaded to Drive without converting it (PDF is a good example); explicitly share this document with others using a particular setting ("anyone with the link"); and then preview it in the web UI and follow an outgoing HTTPS link (HTTP wouldn't be a problem).

Re: Google Drive Found Leaking Private Data

#23

Post by sp332 »

aiiane wrote: post #15
sp332 wrote: post #14

How does the fix work? Does it prevent the browser from sending the referrer URL? Or maybe load all documents from the same URL with the document ID in a POST request instead or GET?

Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.

But it says this was only a problem for documents that were not converted to Google Sheets etc. I don't think editing everyone's PDFs and every other kind of document that has clickable URLs is the easiest way to solve this.

Re: Google Drive Found Leaking Private Data

#25

Post by tanglesome »

This is news? Come on! You give anyone a link to your data and you expect security! Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. Why should I expect my data to be any safer!?

Re: Google Drive Found Leaking Private Data

#27

Post by andreyf »

eli wrote: post #19
nly wrote: post #12

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

Becomes less and less of an issue as sites switch to HTTPS though, right?

Referrers are still sent if you're clicking an https link on an https site, iirc.

Re: Google Drive Found Leaking Private Data

#28

Post by sp332 »

ak217 wrote: post #21
sp332 wrote: post #13

Earlier quoted context omitted.

If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft

What does that have to do with anything? If you issue fraudulent demand drafts, the bank will trace the destination account and send lawyers after you. If you trace referrers and open the origin URL, it's doubtful whether anyone will trace it or have legal recourse against you.

That's not two-factor authentication.

Re: Google Drive Found Leaking Private Data

#29

Post by unreal37 »

eli wrote: post #19
nly wrote: post #12

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

Becomes less and less of an issue as sites switch to HTTPS though, right?

This "vulnerability" only affected HTTPS links, the article said.

Re: Google Drive Found Leaking Private Data

#30

Post by fixermark »

onion2k wrote: post #3

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…

I've always thought of 'Anyone with the link' as functionally equivalent to 'Anyone.' I will continue to think so after this referrer-header change.

The first time you email that link out, you have technologically released your ability to predict who will view the document (was the e-mail sent over secure channels end-to-end? Did it go to a trusted party who won't reshare it? Did you typo the e-mail address and send it to an undesired party? Did a recipient print it out and leave a printed copy lying around in an accessible conference room? Was the printout shredded after use? Was the shredding functionally irreversible? Is the shredding being done by a third-party that might lose some loads of documents on the way to the shred facility? Did you leave the link in your local machine's pastebuffer then walk away without locking your terminal? Etc., etc., etc.).

Even when the link is functionally unguessable, allowing non-authenticated access is just "security through obscurity."

Post reply on HN