Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Drive Found Leaking Private Data

collaboristablog.com

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Google Drive Found Leaking Private Data

#41

Post by dlgeek »

sp332 wrote: post #23
aiiane wrote: post #15

Earlier quoted context omitted.

Normally most outgoing links that are meant to be private are bounced through a redirection that results in the referrer being a generic Google redirection page. That's probably the solution that was applied here.

But it says this was only a problem for documents that were not converted to Google Sheets etc. I don't think editing everyone's PDFs and every other kind of document that has clickable URLs is the easiest way to solve this.

Looks like it only applies to a "Preview" feature, so I imagine they're already parsing the contents to render the preview and are either adding a redirect or a no-follow attribute.

Native-native docs wouldn't have a referrer because they wouldn't be rendered by the browser, so links would be a direct hop.

Re: Google Drive Found Leaking Private Data

#42

Post by ntakasaki »

wfjackson wrote: post #40
rishabhsagar wrote: post #20

I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.

Regardless of this particular issue, it's ironic that people think their Google docs are private. Doesn't Google already have the right to parse your documents in Drive to show you ads? They just recently pledged to stop parsing the paid Google Apps for Business emails to build ad preferences to show on other Google properties like YouTube. I wonder if they're already scanning documents, and if we'd even know unless…

This incident comes to mind.

http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

Hope they have better controls now so that snooping on your data is not so easy for a Google employee now. But they're under no legal obligation since you sign away your rights when you upload data to their server. No one in that case would have a legitimate case against Google in court.

Re: Google Drive Found Leaking Private Data

#43

Post by macwarlock »

bradleybuda wrote: post #34
rishabhsagar wrote: post #20

I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.

That's not the issue. Let's say Alice shares a link to a Drive doc with Bob, https://drive/secretlink . If that document has an embedded link to Eve's website, http://some/thirdparty , and Bob clicks the link, then Eve (as the administrator of the third-party site) will see the HTTP Referer as https://drive/secretlink , and she will be able to access Alice's document.

I think rishabhsagar's metaphor of security through obscurity is indeed the issue. If the secretlink protected only by the difficulty in guessing the URL, and not an additional layer authentication for the person you are sharing it with, then it amounts to hiding something (a key) in plain sight and hoping for the best. Granted, I'm unsure if Google has a mechanism to throttle/block attempts at guessing Drive URLs.

Re: Google Drive Found Leaking Private Data

#44

Post by sharth »

benihana wrote: post #37
eli wrote: post #2

I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL. Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"

> "only people who have the link AND a google account for your company" I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).

So, if I attempt to share a document, I have these options available to me: http://imgur.com/efTUXgY

They include:

     Public on the Web
     Anyone with the link
     lynch.us
     People at lynch.us with the link
     Specific people
Additionally, if I goto https://admin.google.com/AdminHome#AppDetails:service=Drive+..., I have the abilitiy to the set the domain-wide default sharing settings. As seen here: http://imgur.com/RL0eUhZ

Re: Google Drive Found Leaking Private Data

#46

Post by jimktrains2 »

fixermark wrote: post #39
bradleybuda wrote: post #34

Earlier quoted context omitted.

That's not the issue. Let's say Alice shares a link to a Drive doc with Bob, https://drive/secretlink . If that document has an embedded link to Eve's website, http://some/thirdparty , and Bob clicks the link, then Eve (as the administrator of the third-party site) will see the HTTP Referer as https://drive/secretlink , and she will be able to access Alice's document.

Correct, which violates least surprise and is almost certainly not intended behavior. However, the meta-point rishabhsagar touches on is that with an authentication-free access model, this is but one of possibly many potential failure modes. The risk surface is undefined size, but probably larger than your IT professionals are comfortable with.

I guess it depends on what you're expecting. I expect Refer headers to be sent when I click a link or load a resource (ssl restrictions withstanding https://tools.ietf.org/html/rfc2616#section-15.1.3).

Re: Google Drive Found Leaking Private Data

#47

Post by [deleted] »

unreal37 wrote: post #32
lazersharks29 wrote: post #18

Earlier quoted context omitted.

That's still pretty bad, there could be millions of leaked document URL's in the logs of severs all over the internet and users haven't been notified. It looks like Microsoft Onedrive did a similar thing too: https://blog.onedrive.com/update-for-shared-links/ >"We chose not to disable all previously shared links, because the change only applies to a small fraction of shared files. If customers disable and then re-sha…

Highly doubt it's millions. You have to upload a non-native format into Drive, modify the default security settings, and be linking to another HTTPS site and someone has to follow that link. AND the information in the original document has to be sensitive. The odds of that are very, very low.

[deleted]

Re: Google Drive Found Leaking Private Data

#48

Post by jimktrains2 »

andreyf wrote: post #27
eli wrote: post #19

Earlier quoted context omitted.

Becomes less and less of an issue as sites switch to HTTPS though, right?

Referrers are still sent if you're clicking an https link on an https site, iirc.

Yes

> Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

https://tools.ietf.org/html/rfc2616#section-15.1.3

Re: Google Drive Found Leaking Private Data

#49

Post by eli »

andreyf wrote: post #27
eli wrote: post #19

Earlier quoted context omitted.

Becomes less and less of an issue as sites switch to HTTPS though, right?

Referrers are still sent if you're clicking an https link on an https site, iirc.

Huh, for some reason I thought there was a same domain policy there, but you're right. I guess the idea was just to prevent leaking URLs to a completely passive observer.

FWIW, the web would survive without Referer, but it is genuinely useful to site owners, especially in aggregate. Maybe a compromise would be to trim it to just domain rather than full path?

Re: Google Drive Found Leaking Private Data

#50

Post by grannyg00se »

nly wrote: post #12

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

Why do you consider them evil? It's useful for a destination server to be given insight into the previous url and it doesn't expose any private information.

I suppose one might consider their previous url private information, but if that's the case you've go a lot more to worry about than http referers.

Post reply on HN