Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

news.ycombinator.com

Post reply on HN
Print view View original

21–26 of 26 posts

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#21

Post by PeterStuer »

skywhopper wrote: post #15

What team did you report this issue to? I think this is more about the Slack Google Drive plugin's behavior than Google Docs per se. If someone with permission to view the doc takes a screenshot of the first page of the doc and sends that to you, there's nothing really that Google Docs can do to stop that. That's analagous to what's happening here. The Google Docs Slack integration is what's sharing the preview image…

I'm not sure why the plugin has (or needs to have) access to the private doc in the first place. I would expect a communications channel to communicate my link, not act as a third person with priviledged credentials.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#22

Post by GauntletWizard »

PeterStuer wrote: post #21
skywhopper wrote: post #15

What team did you report this issue to? I think this is more about the Slack Google Drive plugin's behavior than Google Docs per se. If someone with permission to view the doc takes a screenshot of the first page of the doc and sends that to you, there's nothing really that Google Docs can do to stop that. That's analagous to what's happening here. The Google Docs Slack integration is what's sharing the preview image…

I'm not sure why the plugin has (or needs to have) access to the private doc in the first place. I would expect a communications channel to communicate my link, not act as a third person with priviledged credentials.

Slack has the permissions because you have enabled Google drive integration, and authenticated your Google account to give that integration permissions to act as you. If you don't enable Google drive integration, you don't get a preview. If you do enable the Google drive integration, slack uses your permissions to generate a screenshot, and send that to the other users. It is you and your effective permissions that are sending a screenshot, bypassing other security.

It is not intuitive if you are not used to how security really works, which is that permissions are granted to masks that you wear, not to any real person. When you give slack permissions to use the drive integration, you are giving them a copy of your mask, and they are you, even unexpectedly. You have a (subconscious) reflex to automatically create and share screenshots of documents that you link, that you have trained via slack's hook. Remove that integration, and everything works as expected.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#23

Post by balaji1 »

tehwebguy wrote: post #10

If I follow correctly yes this is an obvious vulnerability. Someone at Google made the wrong decision to not fix this years ago and keeps doubling down on that decision. If someone does a blog post like “Looking at the first page of 1 billion private Google Docs” they’ll fix it.

basically they are unwilling to admit a mistake and fix a small issue. I have seen a few PMs become super defensive and double down on a decision.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#24

Post by throwaway167 »

15457345234 wrote: post #13
throwaway167 wrote: post #8

Surely it is not just anyone that a link is shared with, but anyone with the link? It's link-bearer open access to a partial document (an entire page) an author marks as not having partial access. Circumvention of Google's authentication procedure. Is that understanding correct? If so, Google's seemingly OK with users believing something's secure, that isn't. And that could cause information leakage by Google's desig…

Isn't this just restating in an obscure and poorly worded fashion what the very clearly worded original post said?

Indeed.

> Is that understanding correct?

I must have phrased these 4 words poorly. I'll try harder next time.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#25

Post by thiago_fm »

Somebody could try to snipe those google doc links and scrape the preview results. I bet that people could find passwords and valuable information from it.

This looks like a security vulnerability to me. I pay for Google Drive, and I'm starting to distrust Google to maintain the safety of my data properly.

Post reply on HN