3 ms·

Are there legitimate risks to doing this? I was nervous about this part of the solution, but I can't think of any plausible scenario of unauthorized access giv

Are there legitimate risks to doing this? I was nervous about this part of the solution, but I can't think of any plausible scenario of unauthorized access given that I use a long, random bucket name, like mediagoblin-39dpduhfz1wstbprmyk5ak29.

tacLog 6y ago
> For someone who resisted hard using a professional service to digitize the videos out of privacy concerns, I'm extremely surprised they ended up create world-readable gcs buckets for files! I was wondering about this for a similar project recently and the best I came up with is that is if someone has a bad browser extension or their system is compromised in general. Couldn't that leak the bucket name to a untrusted 3rd party? What I am trying to say is your good from random people on the internet, but the minute someone compromises one of the systems that has legitimate access they could extract the info they needed to access anything that user accessed. To be clear, I think the risk of this is low and still use security through obscurity myself.
- krallja 6y ago
  If you or your family leaks the URLs, they will be forever accessible since you didn’t use any expiring access tokens.
leafmeal 6y ago
I was wondering this too. This isn't a direct answer to your question, but a quick search turned up this article for finding unsecured assets in a Google bucket https://www.andreafortuna.org/2019/08/07/some-useful-tools-for-finding-unsecure-google-storage-buckets/ https://www.andreafortuna.org/2019/08/07/some-useful-tools-f...
- mtlynch 6y ago
  I'm currently mitigating those risks. The bucket name is not enumerable/guessable, even with brute force tools, and the filenames aren't predictable either. I have bucket enumeration set to forbidden.
  - timc3 6y ago
    Use signed urls on the objects, and in your software for displaying the video create the correct download link on demand.
    - mtlynch 6y ago
      Right, but that's likely multiple days of dev work. MediaGoblin's source code is a bit of a mess, and it's not GCS-aware at all, so it's non-trivial to implement support for GCS signed URLs and secure key management. What would be the value? If my family members send a link to someone else, that person will have the link forever? If the unauthorized person has a link to a video, they can simply download that video and keep it forever anyway. They can't retrieve other videos in the bucket unless they can correctly guess their (not very predictable) filenames.

tacLog 6y ago

> For someone who resisted hard using a professional service to digitize the videos out of privacy concerns, I'm extremely surprised they ended up create world-readable gcs buckets for files! I was wondering about this for a similar project recently and the best I came up with is that is if someone has a bad browser extension or their system is compromised in general. Couldn't that leak the bucket name to a untrusted 3rd party? What I am trying to say is your good from random people on the internet, but the minute someone compromises one of the systems that has legitimate access they could extract the info they needed to access anything that user accessed. To be clear, I think the risk of this is low and still use security through obscurity myself.

krallja 6y ago
If you or your family leaks the URLs, they will be forever accessible since you didn’t use any expiring access tokens.

leafmeal 6y ago

I was wondering this too. This isn't a direct answer to your question, but a quick search turned up this article for finding unsecured assets in a Google bucket https://www.andreafortuna.org/2019/08/07/some-useful-tools-for-finding-unsecure-google-storage-buckets/ https://www.andreafortuna.org/2019/08/07/some-useful-tools-f...

mtlynch 6y ago
I'm currently mitigating those risks. The bucket name is not enumerable/guessable, even with brute force tools, and the filenames aren't predictable either. I have bucket enumeration set to forbidden.
- timc3 6y ago
  Use signed urls on the objects, and in your software for displaying the video create the correct download link on demand.
  - mtlynch 6y ago
    Right, but that's likely multiple days of dev work. MediaGoblin's source code is a bit of a mess, and it's not GCS-aware at all, so it's non-trivial to implement support for GCS signed URLs and secure key management. What would be the value? If my family members send a link to someone else, that person will have the link forever? If the unauthorized person has a link to a video, they can simply download that video and keep it forever anyway. They can't retrieve other videos in the bucket unless they can correctly guess their (not very predictable) filenames.