3 ms·

This not being an official release from Google, using this is potentially worse than giving someone your Google password without fully vetting it. There are so

by CMay 6y ago

This not being an official release from Google, using this is potentially worse than giving someone your Google password without fully vetting it. There are some existing safeguards in place to make a password alone difficult to use, but the app itself would have signed in access to your account and the contents of files. You may think it's simple to watch the app for bad behavior and decide it's safe, but you wouldn't be thinking deviously enough. Nothing against the developer as they may be trustworthy and honest, but don't make the mistake of assuming that someone bold enough to put out something that requires that much trust must by extension be worth trusting. People too often do.

anderspitman 6y ago
Does it ask for your password? I'd expect it to use OAuth.
- colordrops 6y ago
  It would still have access to all of your gdrive content.
- CMay 6y ago
  It wouldn't matter how you signed in for potential abuse to occur if the app itself is untrusted, unfortunately. The repository doesn't include all of the code that gets included in the app, because it has dependencies. It links those dependencies on the github page, but you have to verify that the dependencies being linked to are the ones the build actually uses. Then check that you like what's in those dependencies. At first glance, a forked version of one of the dependencies is pulled from his own repository instead of the repository linked on the page, so you have to make sure you aren't vetting the wrong repository. Then the release archives package in Electron for you, so that's another thing you're trusting if you don't build it locally. It doesn't mean anyone is doing anything wrong, but even if they have good intentions good people pull in bad dependencies occasionally too. Developers as people are innocent until proven guilty. Software is guilty until proven innocent, especially if there's a higher chance of a security risk. Not everyone can assess that well for themselves.
  - ThePowerOfFuet 6y ago
    Very, very well said. Supply chain attacks are a hell of a drug.
  - ngold 6y ago
    >The repository doesn't include all of the code that gets included in the app, Done and done. Thank's for the heads up.
  - smt88 6y ago
    > It wouldn't matter how you signed in for potential abuse to occur if the app itself is untrusted, unfortunately. > The repository doesn't include all of the code that gets included in the app, because it has dependencies.* > Software is guilty until proven innocent I'm not saying you're wrong about any of this, and I don't trust this app myself (mostly because JS dependencies are hard to trust for various reasons), but... I also can't think of any usable app that meets your criteria for trustworthiness, including some made by Google itself. At this point, building much of anything requires standing on a teetering tower of dependencies that users can't and won't audit. The question becomes where one draws the line. I think drawing the line at "anything that touches my Drive files" is reasonable, but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. Although many things are browser-based now, many of us still do download native executable freeware from the web. If you think I'm not offering a better perspective, it's because I'm not. You're right, but total security also currently means using very little of the software that's available to us.
    - scarface74 6y ago
      These days, I’m very careful what gets downloaded on my computer for just that reason. Dropbox for the Mac is a security nightmare and Zoom was doing shady crap before like installing a web server to redownload itself if you uninstalled it. On the other hand, I download all sorts of random crap on my iPad because the security model won’t let apps do anything to shady without you giving it permission.
    - lonelappde 6y ago
      > but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. This is sadly not a valid comparison. Our PCa have a far more critical role in our lives now, have far more power to hurt us, and are reachable by 1000x more malicious actors. We are in a new, dangerous world. We need much better OSes with much stronger sandboxing for our modern world.
marton_s 6y ago
Google does actively prevent "embedded browser" apps - especially shady ones - from stealing Google passwords or other credentials https://security.googleblog.com/2019/04/better-protection-against-man-in-middle.html https://security.googleblog.com/2019/04/better-protection-ag... Electron is known to be affected: https://github.com/electron/electron/issues/22346#issuecomment-590413621 https://github.com/electron/electron/issues/22346#issuecomme... The author of Google Drive Desktop seems to be aware but I do not think anyone can win this race against Google: https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9fb5f16c49b34f05eec919edfbb001ad46bccd/src/javascripts/mainwindow.js#L59-L64 https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9f...
- CMay 6y ago
  That only applies to the password, but the password wasn't really the concern. If you're signed in (no matter how you signed in), a modified browser has the same access to your account that you do with creative possibilities for abusing that. You can argue that if an app isn't trusted then there are other concerns with running it on your machine and that is true too, but some apps want to avoid being too suspect in order to maintain their installation as long as possible. Extra scrutiny in any scenario like this is good. :)

by CMay 6y ago

anderspitman 6y ago

Does it ask for your password? I'd expect it to use OAuth.

colordrops 6y ago
It would still have access to all of your gdrive content.
CMay 6y ago
It wouldn't matter how you signed in for potential abuse to occur if the app itself is untrusted, unfortunately. The repository doesn't include all of the code that gets included in the app, because it has dependencies. It links those dependencies on the github page, but you have to verify that the dependencies being linked to are the ones the build actually uses. Then check that you like what's in those dependencies. At first glance, a forked version of one of the dependencies is pulled from his own repository instead of the repository linked on the page, so you have to make sure you aren't vetting the wrong repository. Then the release archives package in Electron for you, so that's another thing you're trusting if you don't build it locally. It doesn't mean anyone is doing anything wrong, but even if they have good intentions good people pull in bad dependencies occasionally too. Developers as people are innocent until proven guilty. Software is guilty until proven innocent, especially if there's a higher chance of a security risk. Not everyone can assess that well for themselves.
- ThePowerOfFuet 6y ago
  Very, very well said. Supply chain attacks are a hell of a drug.
- ngold 6y ago
  >The repository doesn't include all of the code that gets included in the app, Done and done. Thank's for the heads up.
- smt88 6y ago
  > It wouldn't matter how you signed in for potential abuse to occur if the app itself is untrusted, unfortunately. > The repository doesn't include all of the code that gets included in the app, because it has dependencies.* > Software is guilty until proven innocent I'm not saying you're wrong about any of this, and I don't trust this app myself (mostly because JS dependencies are hard to trust for various reasons), but... I also can't think of any usable app that meets your criteria for trustworthiness, including some made by Google itself. At this point, building much of anything requires standing on a teetering tower of dependencies that users can't and won't audit. The question becomes where one draws the line. I think drawing the line at "anything that touches my Drive files" is reasonable, but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. Although many things are browser-based now, many of us still do download native executable freeware from the web. If you think I'm not offering a better perspective, it's because I'm not. You're right, but total security also currently means using very little of the software that's available to us.
  - scarface74 6y ago
    These days, I’m very careful what gets downloaded on my computer for just that reason. Dropbox for the Mac is a security nightmare and Zoom was doing shady crap before like installing a web server to redownload itself if you uninstalled it. On the other hand, I download all sorts of random crap on my iPad because the security model won’t let apps do anything to shady without you giving it permission.
  - lonelappde 6y ago
    > but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. This is sadly not a valid comparison. Our PCa have a far more critical role in our lives now, have far more power to hurt us, and are reachable by 1000x more malicious actors. We are in a new, dangerous world. We need much better OSes with much stronger sandboxing for our modern world.

marton_s 6y ago

Google does actively prevent "embedded browser" apps - especially shady ones - from stealing Google passwords or other credentials https://security.googleblog.com/2019/04/better-protection-against-man-in-middle.html https://security.googleblog.com/2019/04/better-protection-ag... Electron is known to be affected: https://github.com/electron/electron/issues/22346#issuecomment-590413621 https://github.com/electron/electron/issues/22346#issuecomme... The author of Google Drive Desktop seems to be aware but I do not think anyone can win this race against Google: https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9fb5f16c49b34f05eec919edfbb001ad46bccd/src/javascripts/mainwindow.js#L59-L64 https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9f...

CMay 6y ago
That only applies to the password, but the password wasn't really the concern. If you're signed in (no matter how you signed in), a modified browser has the same access to your account that you do with creative possibilities for abusing that. You can argue that if an app isn't trusted then there are other concerns with running it on your machine and that is true too, but some apps want to avoid being too suspect in order to maintain their installation as long as possible. Extra scrutiny in any scenario like this is good. :)