4 ms·

does this mean that technically (not legally) one can extract API credentials form chromium/chrome and use them in other project?

by gondo 9y ago

KekDemaga 9y ago
You can do that for practically any API you can imagine if you are creative enough.
- gondo 9y ago
  i don't understand what do you mean. how can i do that? f.e. how would i do that with AWS API? the thing with chromium is: it is open source (you can find the credentials), it is meant to be used on any computer via any IP (you can't whitelist API requests)
  - ktta 9y ago
    >the thing with chromium is: it is open source (you can find the credentials) No, you have to get your own API keys via Google Cloud API Manager before building chromium. That's the reason why Chromium on Windows doesn't let you log in. I presume Chromium on linux distros will use an API key of the package maintainer. Also, in most closed source binaries (which chrome is a part because it has binary blobs not present in Chromium - see Google Cast, etc) you will have to sign a EULA where you agree to no disassemble and use that API key, so doing so is illegal too.
  - Gaelan 9y ago
    Chromium != chrome. It doesn’t add much security, but I bet the API keys are added as part of whatever process google uses to build chrome from the chromium source
- jpatokal 9y ago
  You can apply on server-side restrictions on Google API keys: https://developers.google.com/maps/documentation/javascript/get-api-key#key-restrictions https://developers.google.com/maps/documentation/javascript/... https://developers.google.com/maps/faq#keysystem https://developers.google.com/maps/faq#keysystem The most secure approach is to get a premium plan with a cryptographic key and sign your requests serverside. This is complicated/not feasible for some APIs and client-side applications though. Disclaimer: Googler, used to work on Google Maps, nothing to do with Chrome.
  - ec109685 9y ago
    That still doesn't really protect the underlying API from abuse because the intermediate server could be abused by someone who stole that intermediate server's API Key from the app. The benefit is that folks wouldn't have full access to the underlying API, but it may be enough depending on the evil doers purposes.
TorKlingberg 9y ago
Lots of mobile apps ship with API credentials in the binary. The whole thing runs on the honour system basically.

does this mean that technically (not legally) one can extract API credentials form chromium/chrome and use them in other project?

by gondo 9y ago

does this mean that technically (not legally) one can extract API credentials form chromium/chrome and use them in other project?

KekDemaga 9y ago

You can do that for practically any API you can imagine if you are creative enough.

gondo 9y ago
i don't understand what do you mean. how can i do that? f.e. how would i do that with AWS API? the thing with chromium is: it is open source (you can find the credentials), it is meant to be used on any computer via any IP (you can't whitelist API requests)
- ktta 9y ago
  >the thing with chromium is: it is open source (you can find the credentials) No, you have to get your own API keys via Google Cloud API Manager before building chromium. That's the reason why Chromium on Windows doesn't let you log in. I presume Chromium on linux distros will use an API key of the package maintainer. Also, in most closed source binaries (which chrome is a part because it has binary blobs not present in Chromium - see Google Cast, etc) you will have to sign a EULA where you agree to no disassemble and use that API key, so doing so is illegal too.
- Gaelan 9y ago
  Chromium != chrome. It doesn’t add much security, but I bet the API keys are added as part of whatever process google uses to build chrome from the chromium source
jpatokal 9y ago
You can apply on server-side restrictions on Google API keys: https://developers.google.com/maps/documentation/javascript/get-api-key#key-restrictions https://developers.google.com/maps/documentation/javascript/... https://developers.google.com/maps/faq#keysystem https://developers.google.com/maps/faq#keysystem The most secure approach is to get a premium plan with a cryptographic key and sign your requests serverside. This is complicated/not feasible for some APIs and client-side applications though. Disclaimer: Googler, used to work on Google Maps, nothing to do with Chrome.
- ec109685 9y ago
  That still doesn't really protect the underlying API from abuse because the intermediate server could be abused by someone who stole that intermediate server's API Key from the app. The benefit is that folks wouldn't have full access to the underlying API, but it may be enough depending on the evil doers purposes.

TorKlingberg 9y ago

Lots of mobile apps ship with API credentials in the binary. The whole thing runs on the honour system basically.