Be Careful Sharing Your Internal Dashboards | Hacker News Reader

Be Careful Sharing Your Internal Dashboards

seogadget.com

24 pointsrecena3 comments

Paul from Geckoboard here.

To be absolutely clear dashboards are not on Google unless customers decide to put the URL in a blog post or somewhere else on the public internet, this is a non-story.

I.e. no dashboards have been exposed or otherwise leaked by Geckoboard. In order for these dashboards to appear in Google:

  1. Customer switches on sharing for a given dashboard in Geckoboard

  2. Then publishes the sharing URL on the publicly accessible web

  3. Google then indexes that link

In addition to locking down dashboards behind a user/pass or restricting access to only certain IP address customers can, at any time, generate a new sharing URL which denies access to the previous URL.

In a related development we've been advised that this story is being touted around by a PR agency - we're still trying to trace who has employed them but we have a reasonable idea.

>To be absolutely clear dashboards are not on Google unless customers decide to put the URL in a blog post or somewhere else on the public internet, this is a non-story.

No. Jut because Google doesn't index a URL doesn't make it private in any way. Public URLs are public. Relying on obscurity is a bad idea. People are continually amazed at how Google is able to find URLs they thought they had not linked publicly anywhere. Send the link to a gmail user? Google knows it now.

I wouldn't worry too much though; any company prepared to trust vital business data to a SaaS web startup obviously doesn't care about data security very much. People put off by this were never going to use your product anyway.

Ufff, what an advice.

The way to stop sharing the dashboards is to LOCK THEM UP (at least with .htaccess), not just to remove them from Google!

Reply on news.ycombinator.com