Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End of the road for Google Drive in Transmit

blog.panic.com

Post reply on HN
Print view View original

181–190 of 196 posts

Re: End of the road for Google Drive in Transmit

#181

Post by StewardMcOy »

alanfranz wrote: post #164

I’m not sure about how this is happening. Transmit is a desktop app - or does it have a cloud hosted component? If it’s a desktop app, it should be possible to generate an api key and pass it to the desktop app, that’s it. Google doesn’t know or care about who’s using it at that point. The security flow being discussed should impact cloud-hosted applications. What am I missing?

You're not missing anything, it's just that

> Google doesn’t know or care about who’s using it at that point

is incorrect.

Google Drive uses OAuth. Users don't register API keys, apps do, and then users just log in with their Google account.

Google now requires apps to go through manual approval to actually use their OAuth keys, if those apps request certain endpoints. Doesn't matter if the app is local or cloud-hosted, if it makes certain REST requests, it needs special access, and Google controls which API keys get that special access.

See https://developers.google.com/drive/api/guides/api-specific-...

Re: End of the road for Google Drive in Transmit

#182

Post by jsnell »

hn_throwaway_99 wrote: post #158
jsnell wrote: post #87

Earlier quoted context omitted.

They're the ones who will take the blame when a third-party app gets compromised and is used to siphon off people's data. This isn't a theoretical concern. It's pretty much exactly what happened with Cambridge Analytica. Facebook didn't really do anything wrong; they provided an API for data access, people explicitly authorized an app with broad access their data, and it turned out that the app was basically a trojan…

You're leaving out a very important part of the Cambridge Analytica story, which is "transitive permissions". "Normal" people think of transitive permissions very different from computer science folks. That is, the vast majority of people whose data was sucked up by Cambridge Analytica did not explicitly authorize the app. Instead, their friends did, and at the time authorizing a third party app meant the app got to…

Right, thanks for the demonstration about people on HN blaming the API rather than the user or the abuser too. Do you now see why the only realistic option is for platforms to not provide such dangerous unscoped APIs, or in cases where they do provide such an API, have rigorous security and purpose audits?

Re: End of the road for Google Drive in Transmit

#183

Post by fragmede »

davedx wrote: post #178
fragmede wrote: post #152

Earlier quoted context omitted.

> The EU will have fun with this when it catches up. I don't think you know how the EU works.

I live here, I have a fairly good idea. The EU has quite aggressively pursued different big tech companies over the last few years. The fines have become quite material.

That's true, no one could miss that, but the EU is not noted for it's lack of bureaucracy.

Re: End of the road for Google Drive in Transmit

#184

Post by bigfatkitten »

mikeocool wrote: post #54
ianlevesque wrote: post #30

Earlier quoted context omitted.

I think it's relevant that Transmit is a local native app . There's no hosted app exposed to the internet to hack here. Google made one lengthy process that doesn't fit this use case.

Panic runs a cloud-hosted sync service that syncs your credentials and connection info between different instances of Transmit you may have. No idea if that's what google is targeting here, but that is a cloud service, that presumably gets a copy of people's Google Drive OAuth keys if they use Google Drive with Transmit and the sync service.

That isn't a factor in Google's decision making. An app is an app as far as they're concerned, whether it's a local client or some sort of hosted service.

Re: End of the road for Google Drive in Transmit

#185

Post by bigfatkitten »

deely3 wrote: post #137
acdha wrote: post #38

Earlier quoted context omitted.

There’s no way for someone on the internet to reach into your Transmit app and make it do something.

How can you be so sure? Even after reading all the source code, there still can be bugs, attacks, demanding letters from different agencies, misconfigurations, vulnerabilities in code and in libraries, etc. etc. etc.

All of which would also impact the Google Drive client installed on the same machine. None of Google's requirements seek to address this.

Re: End of the road for Google Drive in Transmit

#186

Post by bigfatkitten »

davedx wrote: post #5

> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now have to pay one of Google’s business partners to conduct the review. What a racket. Smells downright anti-competitive The EU will have fun with this when it catches up.

I wonder which VP+ at Google is getting kickbacks from KPMG?

Re: End of the road for Google Drive in Transmit

#187

Post by psd1 »

adamc wrote: post #70
imhoguy wrote: post #51

As per mentioned Ghisler page: "The security assessment would have to be performed by a specialized company, and costs up to $75'000 per year and program (so $150'000 for 32bit+64-bit). This is not sustainable even with a subscription." [0] This is death kiss to indie developement. But paradoxically it is great. Killing interoperability is nail to coffin. This brings more and more focus to alternative solutions out o…

Yep. I use drive but keep waiting for some clear alternative to arrive. My biggest use is just keeping D&D campaign-related materials there. Google is a drag.

Sync thing runs on any device you own. I have a docker container running FileBrowser for Web access.

Re: End of the road for Google Drive in Transmit

#188

Post by psd1 »

adamc wrote: post #64
dewey wrote: post #10

Even the "audit" they require for increasing something simple as your YouTube API quota is already annoying and a massive waste of time, and this is not even close to the one they are requiring from Panic. The quota increase process is roughly: 1) Fill out the same form every year from scratch 2) Send it into the black hole that's Google "support" 3) A few weeks later receive a reply from someone asking a irrelevant…

Just another reason to not deal with Google. Eventually, gravity is going to catch up with them, and they will never recover, because their business culture is shit. Zero interest or focus on the customers.

I think they are already dead, tbh. Much like IBM but not so far advanced.

Re: End of the road for Google Drive in Transmit

#189

Post by psd1 »

amiantos wrote: post #143
hn_throwaway_99 wrote: post #24

I wrote this response to another front page HN article on a similar topic: https://news.ycombinator.com/item?id=41664753 I know everyone loves to dunk on Google, and I definitely agree their communication and customer service to app developers is shite, but this change to permissions scope is a good thing. If you have full, unfettered access to large number of people's Google Drive data, you're a huge target for male…

They're my files in Google Drive. If I've made the choice to buy a product from Panic, and I trust Panic as a company personally, it should be my right to decide to give Panic access to my files in Google Drive. It is not up to Google to shuffle money into the pockets of their security partners under the guise of doing it for my safety. My safety and the safety of my files is my responsibility, not Google's, and it's…

I agree with your point for, say, Linux.

For the plebs, no, they do not have the capacity. Out there is 7 billion meatbags who have had of a million years of selection for a tribal savannah environment, ten thousand years of selection for an agrarian lifestyle, two hundred years of selection for life in cities, and ten years of selection in the information era.

They're fucking children. They are savannah monkeys. They fall victim to rudimentary scams. They are unable to make an informed choice.

When you get into the billions of users, you become a parent to those users. Parents don't let toddlers get into the knife drawer.

Re: End of the road for Google Drive in Transmit

#190

Post by psd1 »

dreadlordbone wrote: post #67
StarterPro wrote: post #34

Earlier quoted context omitted.

If they are connecting to Google Drive, is that not connected to the internet?

Everything's connected to the internet, what the OP was talking about was attack vectors and since Transmit is a local app it really isn't one unless your whole machine is compromised, which in that case you're screwed.

DNS.

If it makes outbound connections and you control DNS, you own it.

I imagine you could do this sitting in a café with an open hotspot.

Post reply on HN