Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Drive Found Leaking Private Data

collaboristablog.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Google Drive Found Leaking Private Data

#71

Post by tiglionabbit »

benihana wrote: post #37
eli wrote: post #2

I'm glad Google fixed this, but if something is important you really shouldn't be securing it merely by giving it an obscure URL. Google Drive makes it very easy to say "only these named people" should have access, or "only people who have the link AND a google account for your company"

> "only people who have the link AND a google account for your company" I'm not on my work computer, but I can't remember there ever being an option for only let people with a company google account see this. If that was the case, why wouldn't that just be on by default (which I would argue is everyone's expected behavior on corporate google drive).

It shows up if you are on a Google Apps account.

Re: Google Drive Found Leaking Private Data

#72

Post by tiglionabbit »

nly wrote: post #12

HTTP referers are evil. I've been using RefControl[0] to block 3rd party referers for years now. [0] http://www.stardrifter.org/refcontrol/ The web wasn't built with privacy in mind. 3rd party cookies and HTTP Referers are just the low hanging fruit.

Perhaps this is a good reason to make referers subject to the same origin policy?

Re: Google Drive Found Leaking Private Data

#73

Post by jpetersonmn »

coldtea wrote: post #35
tanglesome wrote: post #25

This is news? Come on! You give anyone a link to your data and you expect security! Hello! If I gave folk a key to my house I doubt I'll have any my A/V equipment or computers when I come back after a long weekend. Why should I expect my data to be any safer!?

> This is news? Come on! You give anyone a link to your data and you expect security! Yes. I expect security from my bank, from my insurance company, from state agencies, from my email provider, etc. I surely don't expect them to leak my data, and if they do, cause of a bug or incompetence, I want them to fix it. And I want to be informed when they have breaches or fail to secure my data. > Hello! If I gave folk a ke…

> The "helloooo, is this news, of course it's unsafe, whaddaya expected" etc attitude doesn't help raise the bar on data safety.

I would think just the opposite is true. Perpetuating the idea that "Anyone with a link" means anything other than "Anyone" doesn't help raise the bar on data safety.

I'm glad Google made the enhancement to this, but wouldn't classify it as a security issue.

Re: Google Drive Found Leaking Private Data

#74

Post by nucleardog »

esrauch wrote: post #38
andreyf wrote: post #27

Earlier quoted context omitted.

Referrers are still sent if you're clicking an https link on an https site, iirc.

This never made sense to me, why was this behavior defined this way and why has no browser challenged it? A more rational rule would be something like "only send header if the referer url is http, or if the referer and destination have exact match hosts"

Because the spec and implementations came along well before we started putting HTTPS on everything, or even most/many things. Given the number of HTTPS->HTTPS links you would have run across in regular practice the spec and your proposal were probably more or less identical in practice.

As for why it's still that way... I'm sure no one has bothered to really think about it since.

Re: Google Drive Found Leaking Private Data

#75

Post by Dylan16807 »

tiglionabbit wrote: post #70
Dylan16807 wrote: post #54

Earlier quoted context omitted.

More to worry about, such as? URLs aren't protected any less than cookies are, and cookies are the standard way of securing login tokens. Heck with URLs you get the 'secure flag' cookie option for free!

Yes they are. Cookies are subject to the same origin policy. The Referer header is not.

I think you misread. grannyg00se said there is a lot more to worry about than http referers. We don't need a reminder that referer is a problem.

Re: Google Drive Found Leaking Private Data

#76

Post by retroencabulato »

meritt wrote: post #45

https://www.facebook.com/notes/facebook-engineering/protecti... Facebook Engineering's entry on various methods of hiding referrers. This was 4 years ago, so some of these techniques might not still work.

Wow, don't read the comments on that blog.

Re: Google Drive Found Leaking Private Data

#77

Post by grannyg00se »

hnha wrote: post #58
grannyg00se wrote: post #50

Earlier quoted context omitted.

Why do you consider them evil? It's useful for a destination server to be given insight into the previous url and it doesn't expose any private information. I suppose one might consider their previous url private information, but if that's the case you've go a lot more to worry about than http referers.

It's a violation of browsing privacy. It's noone's business how or why I arrived at a webpage.

By what edict?

The general default behaviour has always been to let an http server know where you're coming from so that it can take whatever actions appropriate. I don't see how or why there is a fundamental violation of some "browsing privacy" rule here.

Re: Google Drive Found Leaking Private Data

#78

Post by grannyg00se »

Dylan16807 wrote: post #54
grannyg00se wrote: post #50

Earlier quoted context omitted.

Why do you consider them evil? It's useful for a destination server to be given insight into the previous url and it doesn't expose any private information. I suppose one might consider their previous url private information, but if that's the case you've go a lot more to worry about than http referers.

More to worry about, such as? URLs aren't protected any less than cookies are, and cookies are the standard way of securing login tokens. Heck with URLs you get the 'secure flag' cookie option for free!

Your browsing behaviour in general is being recorded via user patterns, user agent strings, browser configuration, ip address, etc. An interested party can, in general, find out where your browser has been regardless of referer strings. What is so special about the url? It shouldn't contain any information that is meant to be secure.
Post reply on HN