6 ms·

But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?

pmontra 6y ago
It is not. In a project I'm working on we encrypt our secrets with git secret before sending them to GitHub. When we want to quickly share unencrypted secrets between us we drop them as files into a server we access over ssh. That should be OK. The gist of it is that if a secret is in clear on a server outside our organization it's not secret anymore. And yet my customer trust their cloud provider (Google) with their data.
onion2k 6y ago
No, it definitely isn't. Github (and probably others) will show you big scary warning messages if you commit things like AWS keys.
- elliekelly 6y ago
  What about when you commit a file with client data or PII?
- clinta 6y ago
  How does that work on the command line? Does it reject your push? Or is this only for people editing on the github website?
jordache 6y ago
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
- Liquid_Fire 6y ago
  On Firefox you can disable this via an about:config setting (set keyword.enabled to false).
  - jordache 6y ago
    ahh cool.. but a binary toggle is a bit to coarse. it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.
    - gruez 6y ago
      Or just have two text inputs[1]: one for url and one for search, rather than trying to overload two functions into one text input and trying to guess what the user wants. [1] https://support.mozilla.org/en-US/kb/add-search-bar-firefox-toolbar https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...
      - jordache 6y ago
        oooo didn't know that setting was available!
    - clinta 6y ago
      In your search settings you can add keywords. So if you set ? as the keyword for google you can type '? foobar' into the address bar to google for foobar.
- MaxBarraclough 6y ago
  So I'm not the only one. It's even worse than that though, enter 'myintranetsite' and hit return, and you end up on a Google search page. Instead you have to enter 'http://myintranetsite' http://myintranetsite'
  - mschuster91 6y ago
    Type myintranetsite/ instead, this is faster than http:// http:// in front.
    - paulintrognon 6y ago
      Wow, a usefull shortcut I was not aware of. Thanks.
    - londons_explore 6y ago
      As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/". If you prefix with "http://" http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:")
      - reificator 6y ago
        > If you prefix with "http://" http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:") This seems surprising to me. Can you back up this claim?
        andinus 6y ago
        If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason. - https://support.mozilla.org/en-US/kb/search-suggestions-firefox https://support.mozilla.org/en-US/kb/search-suggestions-fire...
        reificator 6y ago
- heavenlyblue 6y ago
  Doesn’t browser hit suggestions API on every type stroke anyway?
  - mkesper 6y ago
    This is easy to turn off, in Firefox, at least.
- vimslayer 6y ago
  I often have the opposite problem: I'm on Firefox and try to google "FooError: Bar happened" and instead of directing to google, Firefox prompts me to select an application to open "fooerror links".
  - andinus 6y ago
    You can enable the search bar, Ctrl-k focuses on it. - https://support.mozilla.org/en-US/kb/add-search-bar-firefox-toolbar https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...
- prophesi 6y ago
  (firstly you should set a different default search engine) It's been nice to use the Firefox setting to have a separate search bar. Your address bar will show more results from your history, which is often what I actually need. Then you can just hit the down arrow to select "Search with x" options. My only minor quip is that your default search engine will be last in the list.
  - bonkabonka 6y ago
    So the latest Firefox broke that for me. It seems to front-run my URLs as I type them and if the result is a 404 it sends me over to DDG with my URL as the search. :/ Really, really obnoxious but I haven't taken the time yet to paw through about:config to see if I can turn it off.
johnnyfaehell 6y ago
Well, if you're using slack for example you'll normally find that business use it to send a lot more senstive stuff to each other than just API keys. If your slack gets breached you've pretty much got yourself a data breach that you'll need to report (if you're covered by GDPR. If you're GitHub is breached you've probably got major issues and need to do a code aduit to make sure there are no backdoors. If any part of your infrastructure is comprised, you're in trouble. If you get to the nity gritty you've got to store senstive data somewhere. Honestly, I find it super annoying when someone is fine with me sending them a link to kibana to which the access details are in slack to see a API key but have an issue with me sending the API key to them via slack. The whole we don't trust slack but we'll send customer data to each other via it, have all of our secret business info on it, but the API key for an internal service that just outputs public info, that's too dangerous. Oh, and then there are the people who store everything on vault or something and then give out the password willy nilly. Mate, if it's got to be encrypted then we shouldn't be giving it out to everytone. If it's got to be given out to everyone then it's not senstive data, it's just private. For most businesses, the main thing you need to keep safe is your database.
plasticmon 6y ago
But atleast you have an SLA with most of these services if you are using them on an enterprise level. You don't have any such SLA with Auth0 when using jwt.io. edit: typo
jcims 6y ago
I work at a place that takes this all very seriously. No. Google search is available but monitored, skype/gitlab/bitbucket/etc are all blocked. Code formatting tools are blocked to the extent possible and people are instructed not to use them. Folks that slip up and get caught are usually written up the first time, after that they are terminated. The only way to legitimately use tools like these from work are if they pass rigorous vendor assessment processes and rock solid contracts in place covered by nine figure E&O policies.
- troebr 6y ago
  Do you work in a field that warrants this kind of stringent requirements or is the security team overzealous? Do these kind of rules extend to using third party libraries etc?
  - jcims 6y ago
    Both probably. Most of these rules have come as a result of regulatory action/audit findings. Efforts to dial these back repeatedly get stymied by people demonstrating the need for such checks. Re: third party libraries, yes absolutely.
tjpnz 6y ago
Depends on who's paying for it. For "free" services like Google Translate I wouldn't put anything work related through it.

It is not. In a project I'm working on we encrypt our secrets with git secret before sending them to GitHub. When we want to quickly share unencrypted secrets between us we drop them as files into a server we access over ssh. That should be OK. The gist of it is that if a secret is in clear on a server outside our organization it's not secret anymore. And yet my customer trust their cloud provider (Google) with their data.

onion2k 6y ago

No, it definitely isn't. Github (and probably others) will show you big scary warning messages if you commit things like AWS keys.

elliekelly 6y ago
What about when you commit a file with client data or PII?
clinta 6y ago
How does that work on the command line? Does it reject your push? Or is this only for people editing on the github website?

jordache 6y ago

i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search

Liquid_Fire 6y ago
On Firefox you can disable this via an about:config setting (set keyword.enabled to false).
- jordache 6y ago
  ahh cool.. but a binary toggle is a bit to coarse. it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.
  - gruez 6y ago
    Or just have two text inputs[1]: one for url and one for search, rather than trying to overload two functions into one text input and trying to guess what the user wants. [1] https://support.mozilla.org/en-US/kb/add-search-bar-firefox-toolbar https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...
    - jordache 6y ago
      oooo didn't know that setting was available!
  - clinta 6y ago
    In your search settings you can add keywords. So if you set ? as the keyword for google you can type '? foobar' into the address bar to google for foobar.
MaxBarraclough 6y ago
So I'm not the only one. It's even worse than that though, enter 'myintranetsite' and hit return, and you end up on a Google search page. Instead you have to enter 'http://myintranetsite' http://myintranetsite'
- mschuster91 6y ago
  Type myintranetsite/ instead, this is faster than http:// http:// in front.
  - paulintrognon 6y ago
    Wow, a usefull shortcut I was not aware of. Thanks.
  - londons_explore 6y ago
    As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/". If you prefix with "http://" http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:")
    - reificator 6y ago
      > If you prefix with "http://" http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:") This seems surprising to me. Can you back up this claim?
      - andinus 6y ago
        If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason. - https://support.mozilla.org/en-US/kb/search-suggestions-firefox https://support.mozilla.org/en-US/kb/search-suggestions-fire...
        reificator 6y ago
heavenlyblue 6y ago
Doesn’t browser hit suggestions API on every type stroke anyway?
- mkesper 6y ago
  This is easy to turn off, in Firefox, at least.
vimslayer 6y ago
I often have the opposite problem: I'm on Firefox and try to google "FooError: Bar happened" and instead of directing to google, Firefox prompts me to select an application to open "fooerror links".
- andinus 6y ago
  You can enable the search bar, Ctrl-k focuses on it. - https://support.mozilla.org/en-US/kb/add-search-bar-firefox-toolbar https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...
prophesi 6y ago
(firstly you should set a different default search engine) It's been nice to use the Firefox setting to have a separate search bar. Your address bar will show more results from your history, which is often what I actually need. Then you can just hit the down arrow to select "Search with x" options. My only minor quip is that your default search engine will be last in the list.
- bonkabonka 6y ago
  So the latest Firefox broke that for me. It seems to front-run my URLs as I type them and if the result is a 404 it sends me over to DDG with my URL as the search. :/ Really, really obnoxious but I haven't taken the time yet to paw through about:config to see if I can turn it off.

johnnyfaehell 6y ago

Well, if you're using slack for example you'll normally find that business use it to send a lot more senstive stuff to each other than just API keys. If your slack gets breached you've pretty much got yourself a data breach that you'll need to report (if you're covered by GDPR. If you're GitHub is breached you've probably got major issues and need to do a code aduit to make sure there are no backdoors. If any part of your infrastructure is comprised, you're in trouble. If you get to the nity gritty you've got to store senstive data somewhere. Honestly, I find it super annoying when someone is fine with me sending them a link to kibana to which the access details are in slack to see a API key but have an issue with me sending the API key to them via slack. The whole we don't trust slack but we'll send customer data to each other via it, have all of our secret business info on it, but the API key for an internal service that just outputs public info, that's too dangerous. Oh, and then there are the people who store everything on vault or something and then give out the password willy nilly. Mate, if it's got to be encrypted then we shouldn't be giving it out to everytone. If it's got to be given out to everyone then it's not senstive data, it's just private. For most businesses, the main thing you need to keep safe is your database.

plasticmon 6y ago

But atleast you have an SLA with most of these services if you are using them on an enterprise level. You don't have any such SLA with Auth0 when using jwt.io. edit: typo

jcims 6y ago

I work at a place that takes this all very seriously. No. Google search is available but monitored, skype/gitlab/bitbucket/etc are all blocked. Code formatting tools are blocked to the extent possible and people are instructed not to use them. Folks that slip up and get caught are usually written up the first time, after that they are terminated. The only way to legitimately use tools like these from work are if they pass rigorous vendor assessment processes and rock solid contracts in place covered by nine figure E&O policies.

troebr 6y ago
Do you work in a field that warrants this kind of stringent requirements or is the security team overzealous? Do these kind of rules extend to using third party libraries etc?
- jcims 6y ago
  Both probably. Most of these rules have come as a result of regulatory action/audit findings. Efforts to dial these back repeatedly get stymied by people demonstrating the need for such checks. Re: third party libraries, yes absolutely.

tjpnz 6y ago

Depends on who's paying for it. For "free" services like Google Translate I wouldn't put anything work related through it.