News for hackers. Stuff that matters.

deepakjc

Sorry about that, I rarely post questions on HN. Forgot to add the "Ask HN: " I don't suppose I can edit it now.
Ah, this is a helpful insight. I didn't realise that this is how the integration works. It seems that, at most, Google could force Slack to update their integration's behaviour (and take down the integration till that happens). But as you mentioned, they can't really fix it themselves.

I probably wouldn't have posted this if I had received this explanation from Google. :)

This was their response: "Hi! We've decided that the issue you reported is not severe enough for us to track it as a security bug: when someone with access to a doc sends a link over slack, they express their intent to share this document, hence the preview shared independently from the sharing setup on the doc does not represent a significant risk."

Wow, 3 separate mentions on HN is pretty high (and those were the ones you were able to find). This must have been reported dozens of times to Google.

That said, if (a) this is only occurring with the 2 conditions you mentioned and (b) if Google Drive integrations are only allowed with vetted partners, then I suppose this is less exploitable. Someone would have to intentionally put the link into a 3rd party application that had some people who shouldn't have access.

Though it still be a problem I think, privacy is important even internally. Sometimes access needs to be revoked, or people are unaware of all the people who have access to a channel etc.

Google marked this vulnerability as "Won't Fix" but I disagree. Care to comment?

tldr; You can view a preview of private Google Docs despite not having access, as long as you have the doc's link.Longer version: I received a link to a Google doc on slack recently, but the owner had forgotten to share permissions with me. Though I couldn't view the doc when I clicked it, I did notice that I could view the first page of the doc in the link preview. It was very high res and I...

( Read More... | 24 comments | 4 points | on HN )
Re:Quake in your browser on Friday June 26, 2015 @06:58AM (#9783487)
I'm on Chrome (on a macbook) and the mouse isn't working... Click works to shoot, but I can't look around using the mouse. Any ideas?

(I'm playing with just the keyboard so far... but I can see the end coming soon.)

Re:Google Analytics Launches Cohort Analysis on Friday February 06, 2015 @01:11PM (#9010509)
Go to your Google Analytics dashboard and check it out.
Re:What Doesn’t Kill Me Makes Me Stronger on Tuesday December 09, 2014 @11:19PM (#8727671)
If this is true... then I need to rethink a lot of my life choices... what is actually good for me?

Would love to hear the opinion of doctors/scientists on this...

Re:What Doesn’t Kill Me Makes Me Stronger on Tuesday December 09, 2014 @11:07PM (#8727640)
A very interesting concept, will definitely need to read more on this!

But what about the kind of research that talks about the dangers of living in cities... like "living in a polluted city is like smoking X cigarettes a day"?

Re:Hacker News Leaderboard on Monday September 29, 2014 @07:15AM (#8382374)
Just saw this today, and the "leaders" are far out of my reach...
Re:How do dolphins sleep without drowning? [video] on Monday September 01, 2014 @12:10AM (#8251508)
Pretty surprising answer, they sleep half their brain at a time!
Re:0^0 on Thursday April 03, 2014 @12:46AM (#7521009)
I read upto "High School Teacher"... skimmed through "Calculus Teacher"... and scrolled through "Mathematician"...

Older »