Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google API keys weren't secrets, but then Gemini changed the rules

trufflesecurity.com

Post reply on HN
Print view View original

41–50 of 326 posts

Re: Google API keys weren't secrets, but then Gemini changed the rules

#41

Post by nimonian »

solid_fuel wrote: post #30
larusso wrote: post #26

Earlier quoted context omitted.

I’m not a native speaker so my level of AI recognition is already low. I find it very interesting what patters people bring up to declare it’s AI. The 3 punchline one for instance is a pattern I use while speaking. Can’t say I would write like this though.

It's not so much the grouping of 3 or way it's supposed to be punchy specifically that's the problem, that is just one example of what gives the article the "LLM Generated" feeling since whatever cheap model people are using for this kind of spam has some common ticks. I use groupings of 3 and try to make things punchy myself sometimes, especially when I'm writing something intended to sway others. I think the proble…

I completely agree with you. There's something conspicuous about this particular use of the "group of three" device. It's trying but it's goofy and conspicuous. I think it's not human, it's 52 trillion parameters in a trenchcoat.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#42

Post by j16sdiz »

louison11 wrote: post #19

This seems so… obvious? How can a company of this size, with its talent and expertise, not have standardized tests or specs preventing such a blatant flaw?

in a company of this size ... left hand don't know what right hand is doing

Re: Google API keys weren't secrets, but then Gemini changed the rules

#43

Post by decimalenough »

827a wrote: post #15
devsda wrote: post #6

> Leaked key blocking. They are defaulting to blocking API keys that are discovered as leaked and used with the Gemini API. There are no "leaked" keys if google hasn't been calling them a secret. They should ideally prevent all keys created before Gemini from accessing Gemini. It would be funny(though not surprising) if their leaked key "discovery" has false positives and starts blocking keys from Gemini.

Yeah its tremendously unclear how they can even recover from this. I think the most selective would be: they have to at minimum remove the Generative Language API grant from every API key that was created before it was released. But even that isn't a full fix, because there's definitely keys that were created after that API was released which accidentally got it. They might have to just blanket remove the Generative…

The Gemini API is not enabled by default, it has to be explicitly enabled for each project.

The problem here is that people create an API key for use X, then enable Gemini on the same project to do something else, not realizing that the old key now allows access to Gemini as well.

Takeaway: GCP projects are free and provide strong security boundaries, so use them liberally and never reuse them for anything public-facing.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#44

Post by WalterGR »

Gigachad wrote: post #38
tyre wrote: post #31

Earlier quoted context omitted.

Using threes is common in English writing and speaking. It has an optimal balance of expressiveness (three marking a pattern or breadth; creating momentum) without being overwhelming. It’s not uncommon, as basic writing advice, to use sets of three for emphasis. That isn’t a signifier of LLM generation, in my opinion.

It's also seemingly the only way ChatGPT knows how to write, while being very uncommon for blogposts beforehand. Of course it's not 100% proof, but it's the most likely explanation.

It has a name. The Rule of Threes. https://en.wikipedia.org/wiki/Rule_of_three_(writing)

“The rule of three is a writing principle which suggests that a trio of entities such as events or characters is more satisfying, effective, or humorous than other numbers, hence also more memorable, because it combines both brevity and rhythm with the smallest amount of information needed to create a pattern.”

It’s how I was taught to write, but I understand that my personal experience can’t be generalized to make sweeping statements.

Do you have data that suggests it’s uncommon in human-authored blog posts and more common in LLM-generated text?

Re: Google API keys weren't secrets, but then Gemini changed the rules

#45

Post by raincole »

bryanrasmussen wrote: post #5
bpodgursky wrote: post #3

ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.

How do you know that this blog post was written by ChatGPT?

It's too well structured and the message is too clear. HN (and the whole internet) is allergic to proper writing. We praise human sloppiness now.

No, I'm not being sarcastic. People have given up em-dash, which is an official punctuation you use in proper writing. And it's all a downhill from there.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#46

Post by decimalenough »

warmedcookie wrote: post #4

What's frustrating is that a lot of these keys were generated a long time ago with a small amount of GCP services that they could connect to. (Ex. Firebase remote config, firestore, etc.) When Gemini came around, rather than that service being disabled by default for those keys, Gemini was enabled, allowing exploiters to easily utilize these keys (Ex. a "public" key stored in an APK file)

Gemini API is not enabled by default, a project owner has to go explicitly enable it.

The problem described here is that developer X creates an API key intended for Maps or something, developer Y turns on Gemini, and now X's key can access Gemini without either X or Y realizing that this is the case.

The solution is to not reuse GCP projects for multiple purposes, especially in prod.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#47

Post by sheept »

phantomathkg wrote: post #23

> 2,863 Live Keys on the Public Internet It will be more interesting if they scan GitHub code instead. The number terrified me. Though I am not sure how many of that are live.

2k feels very small considering the number of business sites that embed Google Maps. I guess a lot of those sites use other website building services that handle the Google API keys for them, and/or they're old and untouched enough that no one enabled Gemini on them.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#49

Post by leptons »

gamblor956 wrote: post #20
louison11 wrote: post #19

This seems so… obvious? How can a company of this size, with its talent and expertise, not have standardized tests or specs preventing such a blatant flaw?

They probably used the in house AI tools to build this.

"This seems fine"

Re: Google API keys weren't secrets, but then Gemini changed the rules

#50

Post by masklinn »

coliveira wrote: post #35
tyre wrote: post #31

Earlier quoted context omitted.

Using threes is common in English writing and speaking. It has an optimal balance of expressiveness (three marking a pattern or breadth; creating momentum) without being overwhelming. It’s not uncommon, as basic writing advice, to use sets of three for emphasis. That isn’t a signifier of LLM generation, in my opinion.

This excerpt is demonstrating the use of a literary technique to write non-literary prose. It's an almost sure sign that an LLM is generating the text.

Of course, how could a writer writing have writing chops and use writing techniques? It boggles the mind that anyone thinks that would ever happens. Must have been aliens.
Post reply on HN