8 ms·

This is because google docs is now widely used as a malware vector. Send the user to a google docs page, and because it is on the google domain it is trusted b

This is because google docs is now widely used as a malware vector. Send the user to a google docs page, and because it is on the google domain it is trusted by corporate firewalls and AV scanners. The 'tracking' is in fact this page: https://www.google.com/url?q=https://wikimediafoundation.org/ https://www.google.com/url?q=https://wikimediafoundation.org... And that alerts the user to the fact they are leaving google and ending up on another site - which hopefully reduces the effectiveness of using google docs to distribute malware.

nemetroid 3y ago
The complaint is about documents exported from Google Docs.
- londons_explore 3y ago
  But thats still a malware vector right?, especially if you can get the victim to export it themselves?
  - deleted 3y ago
    [deleted]
  - wslh 3y ago
    The malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.
    - ceejayoz 3y ago
      The person doing the export isn't necessarily the bad actor.
      - wslh 3y ago
        That's for sure, but what attack vectors do you imagine? If the bad actor, for example, is the owner of the document it can easily put a link to a malware that Google will not detect.
  - negus 3y ago
    It is not. There is no sense at all: you could use manually crafted HTML page with malicious links, there is no benefit in using Google Docs export for this.
    - judge2020 3y ago
      The benefit is as OP said: it bypasses corporate firewalls because it's a google doc. Although I can only reproduce this redirect page in a published doc page[0], not in a pdf export (unless there's another way to download pdf via url trickery) 0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH55jmSWk32fQqV4z2u-3GvFzcaZO-HYY5PlEfMp_tHWdl9y-HKaunyxKUI3nZAe-/pub https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH...
      - crtasm 3y ago
        A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one? The URL to download the export can't be shared as far as I can tell. edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.
        darkwater 3y ago
        > edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems. (thanks for the test) So it's clearly not a possible real vector, and actually they thought about it being a possible vector, otherwise they would not have put the expiration.
      - afandian 3y ago
        I could reproduce on HTML ZIP export but not PDF.
  - cosmojg 3y ago
    Oh, you're right! And by that logic, Hacker News is a malware vector, too, with all these random links hanging around. Maybe we should petition the moderators to integrate Google's tracking links here as well!
  - cryptonector 3y ago
    You can write HTML (or Word, or whatever) yourself w/o Google's help. This "feature" isn't going to stop malware links on exported google docs.
- Chabsff 3y ago
  Expecting an exported document to behave as close as possible as the hosted version is not exactly unreasonable in general.
  - bobbylarrybobby 3y ago
    When I paste a link in Google Docs, the UI tells me that it's preserving the link I pasted. Now, if it converted http://example.com http://example.com to a google redirect link in the doc, then I probably would not be surprised to see it show up the same way in my export.
type0 3y ago
[flagged]
- eclipxe 3y ago
  Why?
- salil999 3y ago
  Google Docs has helped so many people and companies move forward with collaborative document writing and editing. How is that malicious?
afandian 3y ago
But if you visit these they give themselves a free pass. https://www.google.com/url?q=https://www.google.com/ https://www.google.com/url?q=https://www.google.com/ https://www.google.com/url?q=https://www.youtube.com/ https://www.google.com/url?q=https://www.youtube.com/ Doesn't seem fair does it? Is this about "leaving your chosen office suite" or "leaving Google". Here's an interesting one. It gets allowed even though the HTTP cert has lapsed. https://www.google.com/url?q=https://www.keyhole.com/ https://www.google.com/url?q=https://www.keyhole.com/
- salil999 3y ago
  > Doesn't seem fair does it? Is this about "leaving your chosen office suite" or "leaving Google". How is it unfair if they allow their own websites which they maintain and develop to have no malware? > Here's an interesting one. It gets allowed even though the HTTP cert has lapsed. I doubt any human is going through and vetting every website. It's not a perfect system - I'm sure there will be websites through the cracks.
  - afandian 3y ago
    This article is about exported documents, i.e. the point at which you say "I am leaving the ecosystem of my chosen tool". The wording of the interstitial page says "If you do not want to visit that page..." i.e. it's about whether you expected to visit one website or another. Surely google.com is as 'surprising' to the user as any other page. BTW keyhole.com is an old Google-owned domain. From https://infogalactic.com/info/List_of_Google_domains https://infogalactic.com/info/List_of_Google_domains EDIT: From my own experiment exporting a docuemnt it renders links as https://www.google.com/url?q=https://example.com&sa=D&source=editors&ust=XXXXX194612XXXXX&usg=XXXXXw27HWTQHA8yFIRknCTXXXXX https://www.google.com/url?q=https://example.com&sa=D&source... I changed some param values, I don't know what they do. But with the original values it remembered my preference. So it seems like they're tracking and storing clicks.
    - TobyTheDog123 3y ago
      >Surely google.com is as 'surprising' to the user as any other page. The metric isn't how surprising it is, but how potentially malicious it is. The entire point of the redirect is so the user can make a conscious decision not to visit a potentially-malicious page. Google.com and Youtube.com, operated by the same people who made the docs tool, make the entirely-fair assumption that neither contain malware. That being said, I also think it's the wrong argument to make. It makes very little sense that an exported document needs these interstitials. It would make more sense if it applied them to hosted Google Docs, but not things that are self-hosted by an end-user.
LeifCarrotson 3y ago
I run the ClearURLs extension [0], so when I click that link - or most Amazon affiliate links, or an O365 tracking link, or many other tracking links, it sends me straight to the destination without hitting Google's servers. A feature request/complaint is that it doesn't support hovering to see the target URL/check if the particular tracking domain is supported, for example Tom's Hardware uses a "georiot.com" tracker that embeds GR_URL=https%3A%2F%2Fwww.amazon.com%2Fdp... %3Dtomshardware-us-1038331347314950500-20... and doesn't successfully parse out the raw amazon.com/dp/[product ID] link. [0]: https://github.com/ClearURLs/Addon https://github.com/ClearURLs/Addon
hnburnsy 3y ago
Nice of them to put the redirect under google.com, so you cannot easily block it, unlike MS which uses https://nam01.safelinks.protection https://nam01.safelinks.protection.
hn_throwaway_99 3y ago
But I had my pitchfork out and everything... Seriously, 9 times out of 10 when I see stuff like this, I'm happy I can go to the HN comments and see what the real deal is. I don't think Google deserves a free pass in their decisions, and lots of times I see them push things for "user safety" or "better user experience", oh and oh yeah it also happens to allow Google to better track you. But still, Google has tons of competing issues they need to balance, and I loath it when people pretend like their need is the only one that matters. It's like the debate over Google requiring 2FA for logins. "People losing their 2FA device" is a valid concern, but so is the 10 or 100x the people who get hacked with bad passwords. Not arguing there is a single solution, but you can't argue in good faith by pretending the problem Google is trying to address doesn't exist.
- tomjakubowski 3y ago
  Unfortunately in this case you've gone to the HN comments and been misinformed. GP misunderstood the problem. This issue is about Google adding tracking links to links in _HTML exports_ of Google docs.
  - hn_throwaway_99 3y ago
    I'm not misinformed. There are other comments here that make that point, and I think https://news.ycombinator.com/item?id=37779383 https://news.ycombinator.com/item?id=37779383 is a reasonable rejoinder. I think it's fair to argue that exported files should not have redirect links enabled, but as a software engineer I can imagine the complexity involved, or that there are still reasonable malware concerns. Perhaps the decision to have the exports include the redirects should be re-evaluated, but I certainly wouldn't attribute it to malice.
hedora 3y ago
So, this helps users that understand what the redirect page is saying to them, but don't know that clicking hyperlinks in documents takes you to a web page, and also don't know what the address bar is? I'd like to see a flow (screenshots or video or something?) of an actual attack where the redirect page helps people that are actually capable of understanding what the redirect says.
hackideiomat 3y ago
You can implement this without tracking?
sbarre 3y ago
Yeah this is all nice and good except that's not what the URL is... There's a bunch more after the q parameter: &sa=D&source=editors&ust=16965233434352076&usg=Ade5344w26X85-pHzoD-rVkkdfdfBQnJ7B That sure looks like tracking data to me.
- lern_too_spel 3y ago
  That's a signature, so scammers can't send people trusted google.com links and be redirected to a malware site unless the signature verifies with the timestamp. This was standard practice circa 2005.
  - aftbit 3y ago
    Um, except, they can? As clearly shown in the example link in the GP post: https://www.google.com/url?q=https://example.com/ https://www.google.com/url?q=https://example.com/ Google has had this open redirect forever afaict. I guess they don't consider that a serious threat. I think the better answer is that this is tracking, just like they do on all of the search results, to see which links are most popular. There still might be a malware surveillance use case but that's not the only one.
    - lern_too_spel 3y ago
      If there is a verified signature, it skips the confirmation page. Your link does not. The user has to manually confirm that they want to visit a non-Google URL.
      - thibautg 3y ago
        I'm not seeing a confirmation page, it redirects transparently. So it seems that YMMV.
      - aftbit 3y ago
        Ah my mistake. That would be because I long ago installed "google-no-tracking-url" extension into my Firefox. If I use a clean profile in FF or Chrome, it does indeed show a warning screen.
cryptonector 3y ago
> This is because google docs is now widely used as a malware vector. Sending the user via Google is fine when the user is using the google doc as a google doc. It's NOT fine when you export to some file format to share with others as not-a-google-doc. The moment you exit the Google ecosystem is the moment when this sort of protective feature becomes a tracking feature.

nemetroid 3y ago

The complaint is about documents exported from Google Docs.

londons_explore 3y ago
But thats still a malware vector right?, especially if you can get the victim to export it themselves?
- deleted 3y ago
  [deleted]
- wslh 3y ago
  The malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.
  - ceejayoz 3y ago
    The person doing the export isn't necessarily the bad actor.
    - wslh 3y ago
      That's for sure, but what attack vectors do you imagine? If the bad actor, for example, is the owner of the document it can easily put a link to a malware that Google will not detect.
- negus 3y ago
  It is not. There is no sense at all: you could use manually crafted HTML page with malicious links, there is no benefit in using Google Docs export for this.
  - judge2020 3y ago
    The benefit is as OP said: it bypasses corporate firewalls because it's a google doc. Although I can only reproduce this redirect page in a published doc page[0], not in a pdf export (unless there's another way to download pdf via url trickery) 0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH55jmSWk32fQqV4z2u-3GvFzcaZO-HYY5PlEfMp_tHWdl9y-HKaunyxKUI3nZAe-/pub https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH...
    - crtasm 3y ago
      A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one? The URL to download the export can't be shared as far as I can tell. edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.
      - darkwater 3y ago
        > edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems. (thanks for the test) So it's clearly not a possible real vector, and actually they thought about it being a possible vector, otherwise they would not have put the expiration.
    - afandian 3y ago
      I could reproduce on HTML ZIP export but not PDF.
- cosmojg 3y ago
  Oh, you're right! And by that logic, Hacker News is a malware vector, too, with all these random links hanging around. Maybe we should petition the moderators to integrate Google's tracking links here as well!
- cryptonector 3y ago
  You can write HTML (or Word, or whatever) yourself w/o Google's help. This "feature" isn't going to stop malware links on exported google docs.
Chabsff 3y ago
Expecting an exported document to behave as close as possible as the hosted version is not exactly unreasonable in general.
- bobbylarrybobby 3y ago
  When I paste a link in Google Docs, the UI tells me that it's preserving the link I pasted. Now, if it converted http://example.com http://example.com to a google redirect link in the doc, then I probably would not be surprised to see it show up the same way in my export.

type0 3y ago

[flagged]

eclipxe 3y ago
Why?
salil999 3y ago
Google Docs has helped so many people and companies move forward with collaborative document writing and editing. How is that malicious?

afandian 3y ago

But if you visit these they give themselves a free pass. https://www.google.com/url?q=https://www.google.com/ https://www.google.com/url?q=https://www.google.com/ https://www.google.com/url?q=https://www.youtube.com/ https://www.google.com/url?q=https://www.youtube.com/ Doesn't seem fair does it? Is this about "leaving your chosen office suite" or "leaving Google". Here's an interesting one. It gets allowed even though the HTTP cert has lapsed. https://www.google.com/url?q=https://www.keyhole.com/ https://www.google.com/url?q=https://www.keyhole.com/

salil999 3y ago
> Doesn't seem fair does it? Is this about "leaving your chosen office suite" or "leaving Google". How is it unfair if they allow their own websites which they maintain and develop to have no malware? > Here's an interesting one. It gets allowed even though the HTTP cert has lapsed. I doubt any human is going through and vetting every website. It's not a perfect system - I'm sure there will be websites through the cracks.
- afandian 3y ago
  This article is about exported documents, i.e. the point at which you say "I am leaving the ecosystem of my chosen tool". The wording of the interstitial page says "If you do not want to visit that page..." i.e. it's about whether you expected to visit one website or another. Surely google.com is as 'surprising' to the user as any other page. BTW keyhole.com is an old Google-owned domain. From https://infogalactic.com/info/List_of_Google_domains https://infogalactic.com/info/List_of_Google_domains EDIT: From my own experiment exporting a docuemnt it renders links as https://www.google.com/url?q=https://example.com&sa=D&source=editors&ust=XXXXX194612XXXXX&usg=XXXXXw27HWTQHA8yFIRknCTXXXXX https://www.google.com/url?q=https://example.com&sa=D&source... I changed some param values, I don't know what they do. But with the original values it remembered my preference. So it seems like they're tracking and storing clicks.
  - TobyTheDog123 3y ago
    >Surely google.com is as 'surprising' to the user as any other page. The metric isn't how surprising it is, but how potentially malicious it is. The entire point of the redirect is so the user can make a conscious decision not to visit a potentially-malicious page. Google.com and Youtube.com, operated by the same people who made the docs tool, make the entirely-fair assumption that neither contain malware. That being said, I also think it's the wrong argument to make. It makes very little sense that an exported document needs these interstitials. It would make more sense if it applied them to hosted Google Docs, but not things that are self-hosted by an end-user.

LeifCarrotson 3y ago

I run the ClearURLs extension [0], so when I click that link - or most Amazon affiliate links, or an O365 tracking link, or many other tracking links, it sends me straight to the destination without hitting Google's servers. A feature request/complaint is that it doesn't support hovering to see the target URL/check if the particular tracking domain is supported, for example Tom's Hardware uses a "georiot.com" tracker that embeds GR_URL=https%3A%2F%2Fwww.amazon.com%2Fdp... %3Dtomshardware-us-1038331347314950500-20... and doesn't successfully parse out the raw amazon.com/dp/[product ID] link. [0]: https://github.com/ClearURLs/Addon https://github.com/ClearURLs/Addon

hnburnsy 3y ago

Nice of them to put the redirect under google.com, so you cannot easily block it, unlike MS which uses https://nam01.safelinks.protection https://nam01.safelinks.protection.

hn_throwaway_99 3y ago

But I had my pitchfork out and everything... Seriously, 9 times out of 10 when I see stuff like this, I'm happy I can go to the HN comments and see what the real deal is. I don't think Google deserves a free pass in their decisions, and lots of times I see them push things for "user safety" or "better user experience", oh and oh yeah it also happens to allow Google to better track you. But still, Google has tons of competing issues they need to balance, and I loath it when people pretend like their need is the only one that matters. It's like the debate over Google requiring 2FA for logins. "People losing their 2FA device" is a valid concern, but so is the 10 or 100x the people who get hacked with bad passwords. Not arguing there is a single solution, but you can't argue in good faith by pretending the problem Google is trying to address doesn't exist.

tomjakubowski 3y ago
Unfortunately in this case you've gone to the HN comments and been misinformed. GP misunderstood the problem. This issue is about Google adding tracking links to links in _HTML exports_ of Google docs.
- hn_throwaway_99 3y ago
  I'm not misinformed. There are other comments here that make that point, and I think https://news.ycombinator.com/item?id=37779383 https://news.ycombinator.com/item?id=37779383 is a reasonable rejoinder. I think it's fair to argue that exported files should not have redirect links enabled, but as a software engineer I can imagine the complexity involved, or that there are still reasonable malware concerns. Perhaps the decision to have the exports include the redirects should be re-evaluated, but I certainly wouldn't attribute it to malice.

hedora 3y ago

So, this helps users that understand what the redirect page is saying to them, but don't know that clicking hyperlinks in documents takes you to a web page, and also don't know what the address bar is? I'd like to see a flow (screenshots or video or something?) of an actual attack where the redirect page helps people that are actually capable of understanding what the redirect says.

hackideiomat 3y ago

You can implement this without tracking?

sbarre 3y ago

Yeah this is all nice and good except that's not what the URL is... There's a bunch more after the q parameter: &sa=D&source=editors&ust=16965233434352076&usg=Ade5344w26X85-pHzoD-rVkkdfdfBQnJ7B That sure looks like tracking data to me.

lern_too_spel 3y ago
That's a signature, so scammers can't send people trusted google.com links and be redirected to a malware site unless the signature verifies with the timestamp. This was standard practice circa 2005.
- aftbit 3y ago
  Um, except, they can? As clearly shown in the example link in the GP post: https://www.google.com/url?q=https://example.com/ https://www.google.com/url?q=https://example.com/ Google has had this open redirect forever afaict. I guess they don't consider that a serious threat. I think the better answer is that this is tracking, just like they do on all of the search results, to see which links are most popular. There still might be a malware surveillance use case but that's not the only one.
  - lern_too_spel 3y ago
    If there is a verified signature, it skips the confirmation page. Your link does not. The user has to manually confirm that they want to visit a non-Google URL.
    - thibautg 3y ago
      I'm not seeing a confirmation page, it redirects transparently. So it seems that YMMV.
    - aftbit 3y ago
      Ah my mistake. That would be because I long ago installed "google-no-tracking-url" extension into my Firefox. If I use a clean profile in FF or Chrome, it does indeed show a warning screen.

cryptonector 3y ago

> This is because google docs is now widely used as a malware vector. Sending the user via Google is fine when the user is using the google doc as a google doc. It's NOT fine when you export to some file format to share with others as not-a-google-doc. The moment you exit the Google ecosystem is the moment when this sort of protective feature becomes a tracking feature.