Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

1–10 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#5

Post by celdon25 »

rpadovani wrote: post #3

I think it is because they use `googleusercontent.com` for content uploaded by users - that makes sense for security reasons, never ever let users upload content to your main domain.

Can you elaborate on this? What's special about the domain here for security?

Re: To download from Google Drive, you must enable third party cookies?

#6

Post by rpadovani »

celdon25 wrote: post #5
rpadovani wrote: post #3

I think it is because they use `googleusercontent.com` for content uploaded by users - that makes sense for security reasons, never ever let users upload content to your main domain.

Can you elaborate on this? What's special about the domain here for security?

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser.

When doing so, an attacker can steal cookies, and/or invoke APIs for the user.

Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and without any sensitive content allows reducing the blast of the impact.

Real-world example: https://gitlab.com/gitlab-org/gitlab/-/issues/200094

GitLab has APIs under their main domain. Due to a misconfiguration, it was possible to render in the browser user-generated `.svg` files. Thus, a malicious crafted SVG file could bring to a XSS, and accessing a lot of personal user data on the main domain.

There are technical reasons for the shared domain, but if that particular API call was on another domain, the impact of the vulnerability would have been way smaller.

Re: To download from Google Drive, you must enable third party cookies?

#7

Post by thih9 »

dvfjsdhgfv wrote: post #2

Seems like in this particular case, notwithstanding Google's long history of abuse and opportunism, this one is a genuine case when you enable a cookie for technical and not (necessarily) user tracking reasons.

Is it certain that Google will not use these (i.e. cookies enabled for technical reasons) also for tracking?

Some companies are requesting permissions for more or less valid reasons and later using these permissions for their own goals as well.

Re: To download from Google Drive, you must enable third party cookies?

#8

Post by jakub_g »

rpadovani wrote: post #6
celdon25 wrote: post #5

Earlier quoted context omitted.

Can you elaborate on this? What's special about the domain here for security?

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser. When doing so, an attacker can steal cookies, and/or invoke APIs for the user. Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and…

Similarly, long time ago you could have a personal/project website on .github.com. A few years ago they moved all personal/project websites to .github.io instead.

Re: To download from Google Drive, you must enable third party cookies?

#9

Post by rpadovani »

est wrote: post #4

Maybe we could categorize cookie's party by domain's whois record?

Unfeasible.

Whois data are heavily redacted, and not really checked upon, so you have two problems:

* you have access only to redacted data;

* and also if you had access to original data, they are basically free form text;

Re: To download from Google Drive, you must enable third party cookies?

#10

Post by TobTobXX »

celdon25 wrote: post #5
rpadovani wrote: post #3

I think it is because they use `googleusercontent.com` for content uploaded by users - that makes sense for security reasons, never ever let users upload content to your main domain.

Can you elaborate on this? What's special about the domain here for security?

Also, malware detection algorithms decrease their rating for the google.com domain when they encounter malicious content on this domain. Probably not an issue for google specifically, as they themselves control this list for Chrome, but for other companies this might be relevant too.
Post reply on HN