3 ms·

> Both depend on maintaining the secrecy of a specific piece on non-design / non-implementation knowledge. I would say that Google Workspaces' implementation o

> Both depend on maintaining the secrecy of a specific piece on non-design / non-implementation knowledge. I would say that Google Workspaces' implementation of "Anyone with the Link" authorization was never intended to depend on secrecy (or obscurity or what have-you). I would say that we'd need to consider a more expansive and open, permissive model than that. "Anyone who has the link can edit this" should not be considered as "hide this URL from anyone you don't want editing it" but rather "This is a world-writable document. Discovery merely depends on getting the link right." Imagine if this were a massively multiuser Unix system and not the WWW. Your admin creates for you an obscure, long pathname ending in a long base64 filename. It is mode 6777. "Anyone with the pathname" can edit it! Now is the pathname like a password, or is it just a pathname sitting there in the system? Arguably, Unix pathnames are more discoverable than arbitrary Docs links. But the idea is the same, isn't it? A Google Doc/Sheet/Slide/Drive whose permission is "Anyone with the link" may <X> is, when you boil it down, world-writable, no excuses, no ifs-ands-or-buts.

shkkmo 4y ago
> Arguably, Unix pathnames are more discoverable than arbitrary Docs links. But the idea is the same, isn't it? The discoverability is a pretty key difference. If google had a feature that allowed you to enumerate all edit links in their system, then those links would effectively br world writeable. > I would say that Google Workspaces' implementation of "Anyone with the Link" authorization was never intended to depend on secrecy (or obscurity or what have-you). If that was true, the link would just use a document ID, the use of a cryptographic hash does imply some intention that these files won't simply be world writeable and that access is intended to be controlled by sharing of the link. In the specific case, the people using the feature failed to do either. They didn't treat the file as world writeable and they didn't treat the link like a secret. If they had done either, that would have helped.

shkkmo 4y ago

> Arguably, Unix pathnames are more discoverable than arbitrary Docs links. But the idea is the same, isn't it? The discoverability is a pretty key difference. If google had a feature that allowed you to enumerate all edit links in their system, then those links would effectively br world writeable. > I would say that Google Workspaces' implementation of "Anyone with the Link" authorization was never intended to depend on secrecy (or obscurity or what have-you). If that was true, the link would just use a document ID, the use of a cryptographic hash does imply some intention that these files won't simply be world writeable and that access is intended to be controlled by sharing of the link. In the specific case, the people using the feature failed to do either. They didn't treat the file as world writeable and they didn't treat the link like a secret. If they had done either, that would have helped.