Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

The thing that makes this fishy is that I also received an email for my Google Workspace organization about link sharing changing for Google Drive for a security update, and the date it initially takes effect is the same day at this YouTube thing, July 23.

https://support.google.com/a/answer/10685032?hl=en

Could something have happened across their entire Zanzibar/ ACL infrastructure?

View on HN

I completely thought the email I got for this (for my personal Google app domain) was a phishing attempt. Why couldn't they have included the text in the email rather than some generic sketchy "You have a notification" nonsense?

Yeah this one was pretty bad, I had the same reaction.

If there was a link that said "Click here to view your messages", then yeah, I'd agree it would sound like a phishing attempt.

If it was an email saying, "You have a notification" and you have to manually log in to see it, then there's less chance of you clicking on a phishing attempt. Also, if there's any personal/private/sensitive information, this method makes it unavailable over email.

Just shooting from the hip. It could also just be laziness.

You’re training users to click a “you have a notification” email that’s not easy to verify is legit.

You're training users to not click a link in an email, but rather log in from your homepage.

It has a big “click here” button - at least this email did.

Yea better is to tell them to go login and provide no links.

Yeah, that's why it looked so phishy.

Exact text:

"Dear Google Workspace Administrator,

You have an important notification from Google Operations that requires your attention.

Sincerely, The Google Operations Team"

And then there is a clickable link: "Go to Alert Center"

This is the first time I have EVER heard of the Alert Center. So, I also assumed it was made up.

YouTube mentions the Drive change on their blog post[1], and Drive mentions the YouTube change on theirs[2].

[1]: https://blog.youtube/news-and-events/update-youtube-unlisted...

[2]: https://workspaceupdates.googleblog.com/2021/06/drive-file-l...

Could you explain what that is?

https://research.google/pubs/pub48190/

The permissions service at Google. For more details see: https://authzed.com/blog/what-is-zanzibar/

Seems highly unlikely to me (a Google engineer who works on systems that use Zanzibar / Cloud IAM) that this is a result of anything other than a change in policy.

This person seems to believe it's a security issue with video ids, but maybe that's not related to Zanzibar:

https://news.ycombinator.com/item?id=27611436

This is true. There are rumours the key has leaked swirling.

I still find it odd why the Google Drive change would be related to this, but maybe they're not related besides that date being 'migration day'.

Out of curiosity, could you blindly speculate about something that could happen to this service that would require these changes to be made in drive/youtube?

What is Zanzibar?

I found this link: https://research.google/pubs/pub48190/

I really do love this paper.

Reply on news.ycombinator.com