Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google API keys weren't secrets, but then Gemini changed the rules

trufflesecurity.com

Post reply on HN
Print view View original

61–70 of 326 posts

Re: Google API keys weren't secrets, but then Gemini changed the rules

#61

Post by crest »

klooney wrote: post #36

> Retroactive Privilege Expansion. You created a Maps key three years ago and embedded it in your website's source code, exactly as Google instructed. Last month, a developer on your team enabled the Gemini API for an internal prototype. Your public Maps key is now a Gemini credential. Anyone who scrapes it can access your uploaded files, cached content, and rack up your AI bill. Nobody told you. Malpractice/I can't…

They should limit the new features to new API keys that explicitly opt-in instead of fucking over every user who trusted their previous documentation that these keys are public information.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#62

Post by saagarjha »

masklinn wrote: post #50
coliveira wrote: post #35

Earlier quoted context omitted.

This excerpt is demonstrating the use of a literary technique to write non-literary prose. It's an almost sure sign that an LLM is generating the text.

Of course, how could a writer writing have writing chops and use writing techniques? It boggles the mind that anyone thinks that would ever happens. Must have been aliens.

A good writer knows when to use literary techniques.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#63

Post by crest »

827a wrote: post #15
devsda wrote: post #6

> Leaked key blocking. They are defaulting to blocking API keys that are discovered as leaked and used with the Gemini API. There are no "leaked" keys if google hasn't been calling them a secret. They should ideally prevent all keys created before Gemini from accessing Gemini. It would be funny(though not surprising) if their leaked key "discovery" has false positives and starts blocking keys from Gemini.

Yeah its tremendously unclear how they can even recover from this. I think the most selective would be: they have to at minimum remove the Generative Language API grant from every API key that was created before it was released. But even that isn't a full fix, because there's definitely keys that were created after that API was released which accidentally got it. They might have to just blanket remove the Generative…

I hope Google has a database with the creation timestamp for every API key they issued.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#64

Post by locallost »

Happened to me recently, I got a warning in Gemini Studio that a key leaked. I was perplexed initially and then realized what had happened. The proper fix is to limit the key to just Maps APIs. Of course even this is not so easy, as there's a long list of APIs with complicated names. It was at least limited to my domain.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#65

Post by palmotea »

raincole wrote: post #45
bryanrasmussen wrote: post #5

Earlier quoted context omitted.

How do you know that this blog post was written by ChatGPT?

It's too well structured and the message is too clear. HN (and the whole internet) is allergic to proper writing. We praise human sloppiness now. No, I'm not being sarcastic. People have given up em-dash, which is an official punctuation you use in proper writing. And it's all a downhill from there.

> It's too well structured and the message is too clean. HN (and the whole internet) is allergic to proper writing. We praise human sloppiness now.

Yes. And it's only a matter of time that the model companies start to try to train in that "human sloppiness." After all, a lot of their customers want machines that can pass for humans.

> No, I'm not being sarcastic. People have given up em-dash, which is an official punctuation you use in proper writing. And it's all a downhill from there.

I wouldn't be surprised if the internet language of people devolves into a weird constantly-changing mish-mash of slang and linguistic fads. Basically an arms race where people constantly innovate in order to stay distinct from the latest models.

But the end result of that would be probably fragmentation, isolation, and a kind of dark ages. Different communities would have different slang, and that slang would change so fast that old text would quickly become hard to understand.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#66

Post by OakNinja »

devsda wrote: post #13
SecretDreams wrote: post #7

Earlier quoted context omitted.

It's too structured and consistent. Imo. Has that AI smell to it, but I guess humans will eventually also start writing more like the AIs they learn from.

> guess humans will eventually also start writing more like the AIs they learn from. With the AI feedback loop being so fast and tight for some tasks, the focus moves on to delivery than learning. There is no incentive, space or time for learning.

For me personally, both at work and in my free time, I spend _more_ time on writing things _that matter_ since I’ve freed up time by using LLM’s for boilerplate tasks.

My motto is - If it wasn’t worth writing, it won’t be worth reading.

A good example of writing where I’d recommend using LLM’s is product documentation. You pass the diff, the description of the task, and the context (existing documentation) with a prompt ”Update the documentation…”.

Documentation is important but it’s not prose. However, writing a comment on hacker news is.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#67

Post by rawgabbit »

louison11 wrote: post #19

This seems so… obvious? How can a company of this size, with its talent and expertise, not have standardized tests or specs preventing such a blatant flaw?

Security. The final frontier. Where no developer has ever bothered before.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#69

Post by charcircuit »

klooney wrote: post #36

> Retroactive Privilege Expansion. You created a Maps key three years ago and embedded it in your website's source code, exactly as Google instructed. Last month, a developer on your team enabled the Gemini API for an internal prototype. Your public Maps key is now a Gemini credential. Anyone who scrapes it can access your uploaded files, cached content, and rack up your AI bill. Nobody told you. Malpractice/I can't…

Maps keys should not be made public otherwise an attacker can steal them and drain your wallet and use it for their own sites.

Re: Google API keys weren't secrets, but then Gemini changed the rules

#70

Post by ori_b »

ryanjshaw wrote: post #51
SlightlyLeftPad wrote: post #28

Earlier quoted context omitted.

First of all, Google is a shell of the company it used to be. That said, I’d actually argue there’s an evolutionary explanation behind this where at a certain size, and more importantly complexity, an oversight like this becomes even more likely, not less.

Seems like they ought to be dedicated security teams monitoring for exactly this: does a key to X give users access to not-X. Even more bizarre is their VDP team not immediately understanding the severity of the issue.

And slow down the time to ship things? The shareholders wouldn't like that.
Post reply on HN