Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google API keys weren't secrets, but then Gemini changed the rules

trufflesecurity.com

Post reply on HN
Print view View original

191–200 of 326 posts

Re: Google API keys weren't secrets, but then Gemini changed the rules

#191

Post by roywiggins »

bpodgursky wrote: post #9
bryanrasmussen wrote: post #5

Earlier quoted context omitted.

How do you know that this blog post was written by ChatGPT?

> The Core Problem > What You Should Do Right Now > Bonus: Scan with TruffleHog. > TruffleHog will verify whether discovered keys are live and have Gemini access , so you'll know exactly which keys are exposed and active, not just which ones match a regular expression. I don't know exactly, but I'm sure. The cadence, the clarity, the bolding, the italics, it's all just crisp and clean structured and actionable in a w…

I've reached the point where if any blog post has a subheading with some variant of "The Problem", I assume it's been edited with an LLM, because it co-locates with other indicators so strongly.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#192

Post by post-it »

stevage wrote: post #170

I'm a bit surprised by the timeline which seems to say that: - 6 weeks ago Google said they would fix it - 3 weeks ago Google said they were working on it ...but we're publishing the info anyway, so everyone can go nuts with it.

That's the nature of disclosure deadlines. Talk is cheap. If they didn't disclose when they said they would, Google wouldn't feel any pressure to fix the issue.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#193

Post by roywiggins »

Dylan16807 wrote: post #130
SecretDreams wrote: post #7

Earlier quoted context omitted.

It's too structured and consistent. Imo. Has that AI smell to it, but I guess humans will eventually also start writing more like the AIs they learn from.

This is the first time I've seen people accuse AI text of being "too structured and consistent" compared to human text. Usually it's about specific patterns or tons of repetition or outright mistakes.

One example of being "too structured" is that LLMs love an explicit introduction and conclusion even when one that isn't really warranted. It's always telling you what it's going to say, and what it just said.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#194

Post by staticman2 »

petcat wrote: post #164
pineaux wrote: post #150

Earlier quoted context omitted.

I laughed. No in europe when you win a case like this the judge usually forces the losing party to pay the legal expenses of the winner. Especially if the losing party is a big corporation.

It's the same in the US

It is not. Legal fees are rarely awarded in the U.S.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#195

Post by chrisjj »

rezonant wrote: post #105
edoceo wrote: post #74

Earlier quoted context omitted.

Really? I make multiple GCP projects per app. One project for the (eg) Maps API, one for Drive, one for Mail, one for $THING. Internal corp-services might have one project with a few APIs enabled - but for the client-app that we sell, there are many projects with one or two APIs enabled only.

If you ever have to enable public OAuth on such a project, you'll need to provide a list of all the API projects in use with the application, and Google Trust and Safety will pressure you to merge them together into a single GCP project. I've been through it. You can do what you're describing but it's not the model Google is expecting you to use, and you shouldn't have to do that. It seems what happened here is that…

> decided that the Gemini API on GCP should be default enabled to make it easier for people to deploy

Like deciding ATM cabinets should be default open to make it easier for people to withdraw cash.

No, there must be more behind this than overzealotry.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#196

Post by petcat »

staticman2 wrote: post #194
petcat wrote: post #164

Earlier quoted context omitted.

It's the same in the US

It is not. Legal fees are rarely awarded in the U.S.

I should have said if you recover it in your damages, which every competent attorney will push for.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#197

Post by hparadiz »

marcosdumay wrote: post #190
StilesCrisis wrote: post #182

Earlier quoted context omitted.

That's... pretty much how every free trial works? Try signing up for a free month of Amazon Prime or Netflix and see what happens. The entire point of the promotion is retention.

AdSense doesn't present itself as a permanent service you stay subscribed to. (Or at least didn't at the time I've tried to use it. That may have changed, but we don't know when the GP tried it either.)

It wasn't a subscription. My expectation was that it would simply stop once it hit $0. Not really here to argue about it. The tldr is I don't trust Google with this stuff anymore.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#198

Post by StilesCrisis »

SlightlyLeftPad wrote: post #147
zahlman wrote: post #116

Earlier quoted context omitted.

Another takeaway: if Google can become a shell of what it once was (in terms of institutional competence, I assume you mean; Alphabet market cap seems to be doing just fine), so can your organization. As such: making something that isn't supposed to be part of your security strategy, look like it could be , is actually a long-term security risk . Sooner or later a new team will not read your own documentation, and ju…

A thing I’ve learned about market cap in tech recently is that actually very little needs to get done on the core product. The momentum behind the brand is what carries the stock through time. The brand becomes its own compounding monetary instrument. Google had built a very very strong brand over the last 25 years or so. Only now is that starting to shift away from them. Because of that, I think we’ll start seeing t…

YouTube and AdSense are both extraordinarily profitable. Google Play and Cloud are great revenue drivers as well. Search Ads are still the king of the hill, but it's definitely not their only profitable project, and many of the "unprofitable" projects funnel traffic to profitable ones--Chrome gives Search uplift, Google Play can't exist without Android, etc.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#199

Post by StilesCrisis »

ryanjshaw wrote: post #51
SlightlyLeftPad wrote: post #28

Earlier quoted context omitted.

First of all, Google is a shell of the company it used to be. That said, I’d actually argue there’s an evolutionary explanation behind this where at a certain size, and more importantly complexity, an oversight like this becomes even more likely, not less.

Seems like they ought to be dedicated security teams monitoring for exactly this: does a key to X give users access to not-X. Even more bizarre is their VDP team not immediately understanding the severity of the issue.

They do have dedicated teams for exactly these sorts of concerns. They are also swamped with projects and so they can't review big new changes overnight. Google is very likely shipping first and asking questions later.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#200

Post by falcor84 »

qudent wrote: post #151
gib444 wrote: post #138

Earlier quoted context omitted.

[flagged]

I think the fact that it is not possible to put hard spending caps on API keys might be ruled illegal by some EU court soon enough, at least when they sell to consumers (given the explosion of vibecoding end-users making some apps). When I use OpenAI, Openrouter etc., I can put 10 $ on my API key, and when the key leaks, someone can use these 10 $ and that's it. With Google, there is no way to do that - there are ext…

> When I use OpenAI, Openrouter etc., I can put 10 $ on my API key, and when the key leaks, someone can use these 10 $ and that's it.

On that note, I'll just mention that I had discovered over the last while that when you prepay $10 into your Anthropic account, either directly, or via the newer "Extra usage" in subscription plans, and then use Claude Code, they will repeatedly overbill you, putting you into a negative balance. I actually complained and they told me that they allow the "final query" to complete rather than cutting it off mid-process, which is of course silly, because Claude Code is typically used for long sessions, where the benefit of being cut off 52% into the task rather than 51% into it is essentially meaningless.

I ended up paying for these so far, but would hope that someone with more free time sues them on it.

Post reply on HN