Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 26 posts

Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#1

Post by deepakjc »

tldr; You can view a preview of private Google Docs despite not having access, as long as you have the doc's link.

Longer version: I received a link to a Google doc on slack recently, but the owner had forgotten to share permissions with me. Though I couldn't view the doc when I clicked it, I did notice that I could view the first page of the doc in the link preview. It was very high res and I could view the text clearly. Isn't this a security vulnerability worth plugging? I reported it to Google, but they responded with:

"Hi! We've decided that the issue you reported is not severe enough for us to track it as a security bug: when someone with access to a doc sends a link over slack, they express their intent to share this document, hence the preview shared independently from the sharing setup on the doc does not represent a significant risk."

I tried responding that many people have Google Drive links exposed even publicly, but they assume that only those with access can view them. But I got the same response pretty much. Am I missing something here, or is this an oversight by Google?

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#3

Post by balaji1 »

balaji1 wrote: post #2

The product manager was not involved in the decision to mark it "won't fix". Or more likely, even if the PM did see your bug report, the PM doesn't understand the issue.

Stretch: it is the kind of thing that exposes a bug the PM/dev-team didn't catch themselves. So maybe they are trying to sweep it under the rug haha.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#4

Post by kazinator »

The issue means you cannot broadcast the link to people (for instance, plant it on some project dashboard, or paste it into a Slack channel), and then select who gets access. You cannot revoke 100% of the access from someone to whom you've given the link.

The reason you've been given sounds like something frowned upon in HN: a shallow dismissal.

Even if we accept their reasoning, there is still something wrong: users don't know about the behavior. There is no "warning: sharing a link to someone gives them a high resolution preview of a page of the document, which doesn't require permissions". It's not what you would assume in a document sharing system that has permissions.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#6

Post by filleokus »

This issue have been reported multiple times over the years:

- https://news.ycombinator.com/item?id=37854159 (October 2023)

- https://news.ycombinator.com/item?id=32770709 (September 2022)

- https://twitter.com/matbennett/status/1171015871868874757 (September 2019)

So you are at least not the first one to get dismissed.

EDIT: Jogging the memory in the other threads, this happens when the person posting the link have (a) enabled the Drive integration and (b) have permission to view the document.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#7

Post by daviddever23box »

The physical analogy is a cover page, intended to conceal the subsequent contents when stacked on a table.

A tooltip change (warning) to the sharing view would be sufficient to address the concerns that the first page is displayed as part of the preview for those with Google Drive integrations enabled.

You should change your tl;dr to reflect that one can view a preview of the first page of a shared Google Doc, despite not having access, when provided the sharing link and with Google Drive integrations enabled.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#8

Post by throwaway167 »

Surely it is not just anyone that a link is shared with, but anyone with the link?

It's link-bearer open access to a partial document (an entire page) an author marks as not having partial access. Circumvention of Google's authentication procedure.

Is that understanding correct?

If so, Google's seemingly OK with users believing something's secure, that isn't. And that could cause information leakage by Google's design that could lead to fraud and/or other crime.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#9

Post by jsiepkes »

daviddever23box wrote: post #7

The physical analogy is a cover page, intended to conceal the subsequent contents when stacked on a table. A tooltip change (warning) to the sharing view would be sufficient to address the concerns that the first page is displayed as part of the preview for those with Google Drive integrations enabled. You should change your tl;dr to reflect that one can view a preview of the first page of a shared Google Doc, despit…

> A tooltip change (warning) to the sharing view would be sufficient to address the concerns that the first page is displaye

No one reasonably expects something to be viewable in any form if you haven't given permissions for it. Having to tell the user about such a thing via a tooltip is just bad UX design.

I also wonder if Google didn't create a footgun for themselves if some genius at Google in the future decides the preview looked better if they showed 2 pages instead of one in some UI's.

Re: Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

#10

Post by tehwebguy »

If I follow correctly yes this is an obvious vulnerability. Someone at Google made the wrong decision to not fix this years ago and keeps doubling down on that decision.

If someone does a blog post like “Looking at the first page of 1 billion private Google Docs” they’ll fix it.

Post reply on HN