3 ms·
The big story here, and what's circulating on quite a few of the google news reports about this incident, is the apparent "insecurity" of the cloud. If these do
by jpcx01 17y ago
The big story here, and what's circulating on quite a few of the google news reports about this incident, is the apparent "insecurity" of the cloud. If these documents were on an internal network, it would have been much, much harder for the hacker to grab them since most internal networks are firewalled.
This is a huge blow to all of us web app developers looking to sell apps since things like this will make corporations untrustworthy of our defacto security system (username/password + forgot password).
Google Docs needs a "high security" option that removes these easy access points (forgot password), and other web app developers handling sensitive data need to follow suit.
We can fill in that role through some kind of manual process of confirming a person's identity via other means (not entirely sure how, but i'm sure there's a way).
- jonknee 17y agoJust add an optional access limit by IP address.
- jpcx01 17y agoThat actually sounds like a great solution for some companies. Wonder if Google Docs will add this anytime soon. It'll make the cloud app much less useful (mobile access issues, etc). However I think its worth it in certain cases, like if you're a high profile startup or a bank.
- jonknee 17y agoIf it's available as a per file option it balances the usefulness. For documents that need high security you can choose it. Mobile devices should still be able to connect in through a VPN right?
- brown9-2 17y agoOne option for "higher security" could be to have forgot-password services dial a pre-registered phone number to confirm your identity. Probably harder to intercept than an email account's password. This is how Google Voice asks you to confirm your phone number: an automated system dials your number and gives you a random numeric code which you have to enter on the website.