Be Careful Sharing Your Internal Dashboards

#1

Post by recena » Wed, Sep 18, 2013, 11:10 AM UTC

Be Careful Sharing Your Internal Dashboards
seogadget.com

Re: Be Careful Sharing Your Internal Dashboards

#2

Post by annnnd » Wed, Sep 18, 2013, 11:57 AM UTC

Ufff, what an advice.

The way to stop sharing the dashboards is to LOCK THEM UP (at least with .htaccess), not just to remove them from Google!

Re: Be Careful Sharing Your Internal Dashboards

#3

Post by pmjoyce » Wed, Sep 18, 2013, 12:27 PM UTC

Paul from Geckoboard here.

To be absolutely clear dashboards are not on Google unless customers decide to put the URL in a blog post or somewhere else on the public internet, this is a non-story.

I.e. no dashboards have been exposed or otherwise leaked by Geckoboard. In order for these dashboards to appear in Google:

  1. Customer switches on sharing for a given dashboard in Geckoboard

  2. Then publishes the sharing URL on the publicly accessible web

  3. Google then indexes that link

In addition to locking down dashboards behind a user/pass or restricting access to only certain IP address customers can, at any time, generate a new sharing URL which denies access to the previous URL.

In a related development we've been advised that this story is being touted around by a PR agency - we're still trying to trace who has employed them but we have a reasonable idea.

Re: Be Careful Sharing Your Internal Dashboards

#4

Post by anon1385 » Wed, Sep 18, 2013, 2:43 PM UTC

pmjoyce wrote: post #3

Paul from Geckoboard here. To be absolutely clear dashboards are not on Google unless customers decide to put the URL in a blog post or somewhere else on the public internet, this is a non-story. I.e. no dashboards have been exposed or otherwise leaked by Geckoboard. In order for these dashboards to appear in Google: 1. Customer switches on sharing for a given dashboard in Geckoboard 2. Then publishes the sharing URL…

>To be absolutely clear dashboards are not on Google unless customers decide to put the URL in a blog post or somewhere else on the public internet, this is a non-story.

No. Jut because Google doesn't index a URL doesn't make it private in any way. Public URLs are public. Relying on obscurity is a bad idea. People are continually amazed at how Google is able to find URLs they thought they had not linked publicly anywhere. Send the link to a gmail user? Google knows it now.

I wouldn't worry too much though; any company prepared to trust vital business data to a SaaS web startup obviously doesn't care about data security very much. People put off by this were never going to use your product anyway.