Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Drive Found Leaking Private Data

collaboristablog.com

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Google Drive Found Leaking Private Data

#61

Post by TheLoneWolfling »

gus_massa wrote: post #59
macwarlock wrote: post #43

Earlier quoted context omitted.

I think rishabhsagar's metaphor of security through obscurity is indeed the issue. If the secretlink protected only by the difficulty in guessing the URL, and not an additional layer authentication for the person you are sharing it with, then it amounts to hiding something (a key) in plain sight and hoping for the best. Granted, I'm unsure if Google has a mechanism to throttle/block attempts at guessing Drive URLs.

I expect that they have a throttling mechanism, but nevertheless ... I just checked one of my shared documents. It has a 44 long “random” string, it’s alphanumeric with a few symbols. It looks like a version of base64, but let’s assume that it has only 50 characters to choice, so there are 50^44 = 5.7E74 possible addresses (2.9E79 if we assume base64). (Assuming they are using something like a cryptographically secur…

That's in the ideal "system is performing exactly as intended" case, though.

You're assuming that there isn't, for example, a timing attack on the string comparison function. And it doesn't have to be just their server either. It could be, for example, an intermediate proxy server that leaks timing information.

Re: Google Drive Found Leaking Private Data

#62

Post by gumby »

rishabhsagar wrote: post #20

I didn't think "Anyone with link..." setting promised any kind of security. Honestly, I don't think this was a 'security hole', more like a digital equivalent of a home owner hiding house keys under the carpet, hoping no one will look.

> I didn't think "Anyone with link..." setting promised any kind of security

I think it is reasonable for someone to assume it is a capability, and to be surprised by the cascading vulnerability.

Re: Google Drive Found Leaking Private Data

#63

Post by eli »

benihana wrote: post #37
eli wrote: post #2

I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL. Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"

> "only people who have the link AND a google account for your company" I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).

At least for me, the default sharing option is only "specific people" named as being able to view it can view it. (Though, by default, they can also add other people.) Having the link is irrelevant.

Re: Google Drive Found Leaking Private Data

#65

Post by gus_massa »

TheLoneWolfling wrote: post #61
gus_massa wrote: post #59

Earlier quoted context omitted.

I expect that they have a throttling mechanism, but nevertheless ... I just checked one of my shared documents. It has a 44 long “random” string, it’s alphanumeric with a few symbols. It looks like a version of base64, but let’s assume that it has only 50 characters to choice, so there are 50^44 = 5.7E74 possible addresses (2.9E79 if we assume base64). (Assuming they are using something like a cryptographically secur…

That's in the ideal "system is performing exactly as intended" case, though. You're assuming that there isn't, for example, a timing attack on the string comparison function. And it doesn't have to be just their server either. It could be, for example, an intermediate proxy server that leaks timing information.

Yes, I suspect the more probable leaks are dew to malware and mistakes (someone want to post a kittens picture, but he makes a mistake and paste the doc url.)

And your comment is interesting. Are the proxy servers expected to be secure against a timing attack?

(Also, the proxy administrator may be able to see the logs ...)

Re: Google Drive Found Leaking Private Data

#66

Post by pacaro »

me_myself_and_I wrote: post #64

How is this different than DropBox? Maybe dropbox is more obscure and google more open, hence finding this vulnerability is actually a good thing. Just thinking aloud.

Dropbox posted a blog article about their approach to this issue in May — https://blog.dropbox.com/2014/05/web-vulnerability-affecting...

Disclaimer: I work for Dropbox

Re: Google Drive Found Leaking Private Data

#67

Post by wutbrodo »

fixermark wrote: post #30
onion2k wrote: post #3

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the docum…

I've always thought of 'Anyone with the link' as functionally equivalent to 'Anyone.' I will continue to think so after this referrer-header change. The first time you email that link out, you have technologically released your ability to predict who will view the document (was the e-mail sent over secure channels end-to-end? Did it go to a trusted party who won't reshare it? Did you typo the e-mail address and send…

Seriously, I'm not surprised that the average user might not grasp this concept (which is why it's good that Google dealt with this referrer issue), but it's bizarre that so many people on this thread don't. When it comes to pictures etc, it's generally prudent to assume "If you post it on Facebook, it's effectively public"; if anything this is even more true for the "anyone with the link" sharing setting.

Re: Google Drive Found Leaking Private Data

#68

Post by fixermark »

timothya wrote: post #60
fixermark wrote: post #30

Earlier quoted context omitted.

I've always thought of 'Anyone with the link' as functionally equivalent to 'Anyone.' I will continue to think so after this referrer-header change. The first time you email that link out, you have technologically released your ability to predict who will view the document (was the e-mail sent over secure channels end-to-end? Did it go to a trusted party who won't reshare it? Did you typo the e-mail address and send…

It provides as much security as you have trust in the people you share it with. If I set one of my documents to "anyone with the link" just so that I can access it when I'm not logged in, and I'm careful to not share the link with anyone else, then I'd argue that it's still provides some security because I trust myself. If I shared a document with only you (directly, not using the "anyone with the link" permission),…

But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the link with.

Whole-document transformation and copying are a concern, but I think that's usually treated as a different category of issue from "The server I trust to store the data securely gave it up to some anonymous person who passed a correctly-formatted request to it because the server can't know any better."

Re: Google Drive Found Leaking Private Data

#69

Post by timothya »

fixermark wrote: post #68
timothya wrote: post #60

Earlier quoted context omitted.

It provides as much security as you have trust in the people you share it with. If I set one of my documents to "anyone with the link" just so that I can access it when I'm not logged in, and I'm careful to not share the link with anyone else, then I'd argue that it's still provides some security because I trust myself. If I shared a document with only you (directly, not using the "anyone with the link" permission),…

But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the link with. Whole-document transformation and copying are a concern, but I think that's usually treated as a different category of issue from "The server I trust to store the data securely gave it up to some anonymous person who passed a correctly-formatted reque…

Yes, certainly this particular bug was serious and a real problem that needed to be fixed. The link should not be shared accidentally like that.

I was just making the case that "Anyone with the link" still provides some security. Just like you don't know if the people accessing the document are the ones that you shared the link with, you don't know that the people you shared the document contents themselves with aren't showing others without your knowledge.

Re: Google Drive Found Leaking Private Data

#70

Post by tiglionabbit »

Dylan16807 wrote: post #54
grannyg00se wrote: post #50

Earlier quoted context omitted.

Why do you consider them evil? It's useful for a destination server to be given insight into the previous url and it doesn't expose any private information. I suppose one might consider their previous url private information, but if that's the case you've go a lot more to worry about than http referers.

More to worry about, such as? URLs aren't protected any less than cookies are, and cookies are the standard way of securing login tokens. Heck with URLs you get the 'secure flag' cookie option for free!

Yes they are. Cookies are subject to the same origin policy. The Referer header is not.
Post reply on HN