4 ms·
Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So t
by Bhilai 8y ago
Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So there is definitely more transparency required about their internal investigation and how they are so certain. Just because Google has a great security team, I would not put my blind faith on them.
- skybrian 8y agoI don't believe they made that claim? They said they didn't have evidence that the API was abused.
- lmkg 8y agoThey said that they kept logs for only two weeks, because the logs themselves contained private information. Those logs contained no evidence of abuse.
- joshuamorton 8y ago>Google admitted that they don't keep any logs around. They didn't say that, they stated that in the logs they had, which were not fully comprehensive, there was no evidence of abuse. > am not sure how they are making the claim that their API was not abused. They didn't claim this. But one could, for example, set up a honeypot and monitor any suspicious activity going forward, then if anyone attempted to abuse the vulnerability before it was publicized, they would know it might have been abused, but lack of use over a long timescale could give reasonable certainty that no one took advantage of the vuln. (I work at Google, but not on G+ and not on security).