Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

31–40 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#31

Post by etherealG »

bane wrote: post #14
zerovox wrote: post #2

Misleading headline. They blocked it for a few hours until n people complained. There was more legitimate use than expected, so they unblocked it again.

The real question is, as IT professionals, why would there be more use than expected? Would you expect the premier free cloud competitor to Office to be heavily used? It's as misguided as most of the IT departments I've had to deal with blocking browsers other than IE because they are "insecure". No the other browser are not insecure, they just haven't bothered getting up to speed on the security profile of those bro…

funny, each security bulletin implies something was wrong with security before the bulletin. so regulars implies less security not more, the exact opposite of their thought process.

Re: Oxford Temporarily Blocks Google Docs

#33

Post by pwthornton »

bane wrote: post #14
zerovox wrote: post #2

Misleading headline. They blocked it for a few hours until n people complained. There was more legitimate use than expected, so they unblocked it again.

The real question is, as IT professionals, why would there be more use than expected? Would you expect the premier free cloud competitor to Office to be heavily used? It's as misguided as most of the IT departments I've had to deal with blocking browsers other than IE because they are "insecure". No the other browser are not insecure, they just haven't bothered getting up to speed on the security profile of those bro…

Yes, they should have known better. Google Docs is used a lot at universities because of its collaborative abilities. If you need to work with several people putting a report together, Google Docs is a great way to get started. We often eventually take it out of Docs into a desktop program to finish it off, but Google Docs is one of the best ways to collaborate.

How the IT department didn't know what its students, faculty and staff were doing is kind of hard to believe. For students and teachers in particular, Google Docs is a big deal. It's not just because it's a cloud version of Office, but rather that it has things that Office can't do that are especially important in a university setting.

Re: Oxford Temporarily Blocks Google Docs

#34

Post by Semaphor »

betterunix wrote: post #18
anonymouz wrote: post #9

Earlier quoted context omitted.

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not wil…

> How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users.

Costs. At my university (though of course slightly smaller than Oxford) that would never work.

> Also, digitally sign all official mail, and instruct the users to check those signatures.

Have you met users? That's as good as saying they shouldn't be idiots and never enter their credentials in a site linked in a mail. If that would work all anti virus vendors could close shop.

Re: Oxford Temporarily Blocks Google Docs

#35

Post by blisterpeanuts »

chalst wrote: post #22
blisterpeanuts wrote: post #13

Summary of the blog posting: Google Docs forms are being used in phishing attacks against stupid users. We closed down Google Docs. It didn't work and we had to open it up again after 2.5 hours. Unfortunately, there's no easy solutions to so-called phishing attacks other than educating users. I would recommend that the IT dept. dedicate its considerable resources and creativity to that end, and try to minimize use of…

considerable resources This is a British university, not Goldman Sachs. The action was a dramatic, low-cost effort to get users' attention, educating users, if you like (from OP): > While this wouldn’t be effective for users on other networks, in the middle of the working day a substantial proportion of users would be on our network and actively reading email. A temporary block would get users’ attention and, we hope…

"get users' attention"

I took that to mean, we were planning a longer term outage, but when it inconvenienced Someone Important, we were forced to reinstate the service, and to cover our rears, we're now claiming it was planned as a 2-hour outage from the very start.

Re: Oxford Temporarily Blocks Google Docs

#36

Post by etherealG »

fixed_input wrote: post #26

"We have to ask why Google, with the far greater resources available to them, cannot respond better. Indeed much, if not all, of the process could be entirely automated." The problem lies with the people on the Internet though. I doubt the whole thing could be automated because of the simple fact that there are people out there who, just to troll, would and probably already zip through plenty of legitimate public Goo…

I think a reasonable solution here would be to only automate reported abuse with a registered account, and only automate a certain number per account per time. it wouldn't be insurmountable to abuse, but you push the barrier for abuse over the average troll's willingness.

not a perfect solution, but would help cover a sizeable volume of this kind of phishing attacks.

Re: Oxford Temporarily Blocks Google Docs

#38

Post by pfortuny »

betterunix wrote: post #18
anonymouz wrote: post #9

Earlier quoted context omitted.

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not wil…

Your solutions do not take into account the main problem with the security department: budget. There is a huge budgetary crisis in ALL european universities at this moment, including Oxford and Cambridge.

I bet if they ask for the resources to implement all those solutions, they will be told: find something at zero cost, I repeat zero-cost. Roger that?

Not that I agree blocking google docs is reasonable, just pointing out the problems with your suggestions.

Re: Oxford Temporarily Blocks Google Docs

#40

Post by praptak »

If a fixed login/password pair is enough for someone from external network to send mass e-mail via your network, you have a problem.

Obviously I know little about their network so I'm probably already sounding arrogant but there are some solutions that (generally) have better inconvenience/security ratio than just plain login&pass. Especially if you account for the inconvenience of getting the whole site blacklisted. My site uses one-time, limited-time passwords to authorize external connections but the users are tech savvy so I'm not sure if it works in general settings.

Post reply on HN