Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

161–170 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#161

Post by littlecranky67 »

lucavice wrote: post #66
littlecranky67 wrote: post #55

Earlier quoted context omitted.

Not if its publicly called from Javascript, as your user's browser will make those requests. You neither know their IP addresses, nor is the referer or origin header a safe choice as it can be spoofed outside of a browser.

If it's called from Javascript in the browser, it's not a secret API key....

there are plenty of API keys distributed like this by design. For example, google maps requires this, else your (anonymous) users can't use an embedded google map on your website. And a public firebase app needs some kind of API key, too.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#162

Post by sdevonoes »

jubilanti wrote: post #151
ch0wn wrote: post #142

Earlier quoted context omitted.

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

Not if your contractor had you first sign a 15 page contract that commits you to whatever costs they dream up and requires forced arbitration by a corporate friendly firm when any dispute arises. Because that's somehow normal in today's tech world.

So if their TOS say they can also rape my cat, then I cannot do anything about it, right? Ridiculous

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#163

Post by naturalauction »

We had this exact same problem (the key initially wasn’t a secret but became a secret once we enabled Gemini API with no warnings).

We managed to catch it somewhat early through alerting, so the damage was only $26k.

We asked our Google cloud support rep for a refund - they initially came back with a no but now the case is under further consideration.

I’d escalate this up the chain as much as possible.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#164

Post by sdevonoes »

_nhh wrote: post #160

With AI there is NO justification in NOT DOING IT BY YOURSELF. Why use firebase or if you can generate by yourself and deploy to hardware you own or rent.

That’s replacing Google with OpenAI/aanthropic/whatever. Same shit

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#165

Post by addandsubtract »

zozbot234 wrote: post #78
embedding-shape wrote: post #13

Considering the amount of repositories on public GitHub with hard-coded Gemini API tokens inside the shared source code ( https://github.com/search?q=gemini+%22AIza%22&type=code ), this hardly comes as a surprise. Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly, but I'm not sure everyone got that…

> Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly This was reported a long time ago, and was supposed to be fixed by Google via making sure that these legacy public keys would not be usable for Gemini or AI. https://news.ycombinator.com/item?id=47156925 https://ai.google.dev/gemini-api/docs/troubl…

FWIW, I just create a new Gemini API key today, and it had a different format than my old ones (created 10 days ago). So maybe they changed something?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#166

Post by logankilpatrick »

whywhywhywhy wrote: post #137
Maxious wrote: post #98

Earlier quoted context omitted.

> The Gemini API supports monthly spend caps at both the billing account tier and project levels. These controls are designed to protect your account from unexpected overages, and the ecosystem to ensure service availability https://ai.google.dev/gemini-api/docs/billing#project-spend-...

Why is the default uncapped then other than the hopes of billing people who screw up or get exploited.

We have a bunch of different protections in place, every account has a billing account cap by default (see: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap...), in the addition to the ability to set more granular developer spend caps.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#167

Post by adriand »

janandonly wrote: post #138
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Yet another good reason to use a pre-paid service. There are many to choose from now, like Openrouter.com, PPQ.ai, and routstr.com.

You mean openrouter.ai. And yes, on reading this blog post, I immediately reviewed my API keys in OpenRouter to make sure that they were capped. My prod key was capped at $20/day (phew!) but my dev key had no cap, which I just updated. What a horrible story.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#168

Post by jamespo »

drfloyd51 wrote: post #149
whywhywhywhy wrote: post #137

Earlier quoted context omitted.

Why is the default uncapped then other than the hopes of billing people who screw up or get exploited.

See also: Why is the default cap so low? I lost €78bojillion because my API stopped working.

Monitoring could pick this up in minutes rather than how long this took to discover

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#169

Post by walthamstow »

radlad wrote: post #154
walthamstow wrote: post #147

Earlier quoted context omitted.

I'm with you. And what do you even do when the quota is breached, nuke the resources? People will complain about that just as much as overspends. I don't buy the 'evil corp screwing people' angle either. They are making farrr too much legit money to care about occasionally screwing people out of 20k and 50k.

If I set a limit, and you cut off my service because I reached the limit, I would definitely not "complain just as much" as if I set a limit and you allowed me to spend past it. We're not talking about an EC2 or EBS volume here, this is access to an API.

Meh, you probably would complain. Maybe you forgot you set it. Now your project is taking off, making money, and it got nuked.

Why aren't we talking about an EC2 - is that not a cloud compute service? People have been complaining about cloud billing since long before LLMs.

Anything to say about the technical problem of constantly monitoring many services against a project or account-level limit?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#170

Post by logankilpatrick »

startages wrote: post #152
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap...

By default, new Tier 1 paid accounts can only spend $250 in a given month.

Post reply on HN