More Security Loopholes Found In Google Docs

Re:More Security Loopholes Found In Google Docs by sounddust on Thursday March 26, 2009 @11:57AM (#533629)

I disagree with you about #1. There is no reason that serving these images shouldn't go through the same authentication that accessing the document requires (not DRM'd PDFs, just checking the cookies of the request for that image to make sure the user is logged in and has access to the doc). Just because they're available through a non-guessable URL doesn't make them secure; there are dozens of ways that URL can leak without leaking the whole document.

Also the fact that the image is permanently retained after the document is deleted is completely unacceptable. It's obvious that they are trying to save money on bandwidth and CPU here, but it's not an acceptable place to cut corners.

As for #3, I think that it's pretty easy to guess what this vulnerability is. It's probably the following: When you get an invite to view a shared document, either 1) Accepting the invitation after the document has changed and permission redacted still gives you permission to see it 2) After your permission is revoked, you can use that URL to regain permission to the document.

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by tptacek on Thursday March 26, 2009 @12:27PM (#533681)

Re #3: that does appear to be the case. Create a document, edit it, add a collaborator, verify they got the invite email (but don't sign in for it), remove all collaborators, edit, save, then follow the invite; you'll see the most recent copy of the document in the invite landing screen.

I disagree with you on points #1 and #2. A lot of very important web apps are very insecure if crypto-strong nonce URLs aren't good enough. Clearly relying on URLs is suboptimal, but it's a long way down from "suboptimal" to "vulnerable".

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by sounddust on Thursday March 26, 2009 @12:58PM (#533730)

Well, in my view security is not a binary, nor is there a silver bullet which renders all software secure. Security is a strategy in which one implements as many known protections as reasonably possible in order to reduce vulnerability. In the Google Docs case, I think there is absolutely no good reason not to authenticate HTTP request for components of a document that also requires authentication.

Sure, crypto-strong nonce URLs are better than unobfuscated URLs, but that's just one protection.

For example, let's say that Google accidentally leaks a directory listing of all files on a particular google docs server (or let's say an access log, to be even more realistic). If Google had properly authenticated access to these images, then the leaked access log would be worthless and unexploitable. However, without authenticating these requests, Google has suddenly caused a mass security breach, as hundreds of people rush to wget all the URLs before the images are taken down.

If Google is seriously expecting people to use their product as a replacement for a business intranet, then they need to take seriously all concerns.

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by jongraehl on Thursday March 26, 2009 @01:36PM (#533799)

Nitpick: a nonce is supposed to be used only once (safe against replay). I think you both mean the URL is supposed to be secret. I agree that there are many ways (e.g. web proxies) for a URL to become not-secret.

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by tptacek on Thursday March 26, 2009 @02:53PM (#533928)

I'm corrupting the term "nonce" regularly, but OK, I'll stick with "token". I think "URL" leaves the mistaken impression that there is some way to pull a Google doc out of thin air; something else has to have gone wrong for these problems to impact you.

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by tptacek on Thursday March 26, 2009 @01:11PM (#533750)

You say that as if to imply that documents managed by conventional office suites were in any way secure to begin with. You seem smart enough to realize that isn't the case.

[ Parent | on HN ]

Re:More Security Loopholes Found In Google Docs by sounddust on Thursday March 26, 2009 @01:23PM (#533774)

It's less about documents being managed by conventional office suites and more about sharing documents through Google Docs as opposed to a corporate intranet (and I've seen ones much better-managed and worse-managed than Google Apps).

But the insecurity of desktop document suites doesn't give Google a free pass on having lax security standards.

Of course, this is my evaluation. You and your organization are welcome to use Google Docs if you are comfortable with their security practices.

[ Parent | on HN ]