5 ms·

>Today’s belated announcement of a security breach related to Google+, People keep calling it a breach, but I thought it was merely an unexploited vulnerabilit

>Today’s belated announcement of a security breach related to Google+, People keep calling it a breach, but I thought it was merely an unexploited vulnerability? I may have missed it, but did it come out that there was a breach as well?

kenhwang 8y ago
> merely an unexploited vulnerability The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited earlier than that.
- foobiekr 8y ago
  A source would be great if there is one.
  - rconti 8y ago
    I don't know about "2 weeks" but it was clear from Google's announcement that they had no idea. I remember this, because it was posted on an HN thread where the poster claimed it was "unexploited" so I went in expecting that, and Google's own words made it clear they had no idea.
  - deleted 8y ago
    [deleted]
  - kenhwang 8y ago
    Straight from their announcement https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
    - foobiekr 8y ago
      thank you
- puzzle 8y ago
  They would also have logs of any further attempts to exploit the vulnerability after it was found. I haven't seen anyone mention that. Although it's still no definitive proof, it can be useful corroborating evidence. (I left Google years ago, so I have no insider knowledge about the issue.)
- disfadbish 8y ago
  Google has WAY more than 2 weeks worth of logs. When I was there having 90 days of live logs was the norm with very few exceptions. Anything older wasn't "live" but pretty easily accessible if you can get the resources approved.
michaelermer 8y ago
They don't tell if it was exploited, all they said was "we have no logs".
glenrivard 8y ago
It was a bug that exposed data but no evidence a breach. The right wing has it our for Google and why we get the garbage articles.
908087 8y ago
Google has done a great job of spinning this as "unexploited". The reality of it is (if you take them at their word and believe they only kept 2 weeks of logs "because privacy", which is suspicious for a company that thrives on data collection), they have no idea whether or not it was exploited.

kenhwang 8y ago

> merely an unexploited vulnerability The footnote there is, unexploited in the last 2 weeks they had logs for. They have no way of knowing if it was exploited earlier than that.

foobiekr 8y ago
A source would be great if there is one.
- rconti 8y ago
  I don't know about "2 weeks" but it was clear from Google's announcement that they had no idea. I remember this, because it was posted on an HN thread where the poster claimed it was "unexploited" so I went in expecting that, and Google's own words made it clear they had no idea.
- deleted 8y ago
  [deleted]
- kenhwang 8y ago
  Straight from their announcement https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
  - foobiekr 8y ago
    thank you
puzzle 8y ago
They would also have logs of any further attempts to exploit the vulnerability after it was found. I haven't seen anyone mention that. Although it's still no definitive proof, it can be useful corroborating evidence. (I left Google years ago, so I have no insider knowledge about the issue.)
disfadbish 8y ago
Google has WAY more than 2 weeks worth of logs. When I was there having 90 days of live logs was the norm with very few exceptions. Anything older wasn't "live" but pretty easily accessible if you can get the resources approved.

michaelermer 8y ago

They don't tell if it was exploited, all they said was "we have no logs".

glenrivard 8y ago

It was a bug that exposed data but no evidence a breach. The right wing has it our for Google and why we get the garbage articles.

908087 8y ago

Google has done a great job of spinning this as "unexploited". The reality of it is (if you take them at their word and believe they only kept 2 weeks of logs "because privacy", which is suspicious for a company that thrives on data collection), they have no idea whether or not it was exploited.