News for hackers. Stuff that matters.

A comment on Google Drive Found Leaking Private Data. Parent comment

Re:Google Drive Found Leaking Private Data by fixermark on Wednesday July 09, 2014 @12:02PM (#8010353)
Correct, which violates least surprise and is almost certainly not intended behavior.

However, the meta-point rishabhsagar touches on is that with an authentication-free access model, this is but one of possibly many potential failure modes. The risk surface is undefined size, but probably larger than your IT professionals are comfortable with.

[ Parent | on HN ]
Re:Google Drive Found Leaking Private Data by jimktrains2 on Wednesday July 09, 2014 @12:24PM (#8010480)
I guess it depends on what you're expecting. I expect Refer headers to be sent when I click a link or load a resource (ssl restrictions withstanding https://tools.ietf.org/html/rfc2616#section-15.1.3).
[ Parent | on HN ]