5 ms·
Well, in my view security is not a binary, nor is there a silver bullet which renders all software secure. Security is a strategy in which one implements as ma
by sounddust 18y ago
Well, in my view security is not a binary, nor is there a silver bullet which renders all software secure. Security is a strategy in which one implements as many known protections as reasonably possible in order to reduce vulnerability. In the Google Docs case, I think there is absolutely no good reason not to authenticate HTTP request for components of a document that also requires authentication.
Sure, crypto-strong nonce URLs are better than unobfuscated URLs, but that's just one protection.
For example, let's say that Google accidentally leaks a directory listing of all files on a particular google docs server (or let's say an access log, to be even more realistic). If Google had properly authenticated access to these images, then the leaked access log would be worthless and unexploitable. However, without authenticating these requests, Google has suddenly caused a mass security breach, as hundreds of people rush to wget all the URLs before the images are taken down.
If Google is seriously expecting people to use their product as a replacement for a business intranet, then they need to take seriously all concerns.
- tptacek 18y agoYou say that as if to imply that documents managed by conventional office suites were in any way secure to begin with. You seem smart enough to realize that isn't the case.
- sounddust 18y agoIt's less about documents being managed by conventional office suites and more about sharing documents through Google Docs as opposed to a corporate intranet (and I've seen ones much better-managed and worse-managed than Google Apps). But the insecurity of desktop document suites doesn't give Google a free pass on having lax security standards. Of course, this is my evaluation. You and your organization are welcome to use Google Docs if you are comfortable with their security practices.
- jongraehl 18y agoNitpick: a nonce is supposed to be used only once (safe against replay). I think you both mean the URL is supposed to be secret. I agree that there are many ways (e.g. web proxies) for a URL to become not-secret.
- tptacek 18y agoI'm corrupting the term "nonce" regularly, but OK, I'll stick with "token". I think "URL" leaves the mistaken impression that there is some way to pull a Google doc out of thin air; something else has to have gone wrong for these problems to impact you.