Hacker News Reader

Comment by onion2k | Hacker News Reader

That's a very poorly worded security setting. If you're building a service where people can share something set as "Anyone with link...", you really ought to make it very clear that means it's open for anyone to download. The setting should really be named 'Remove privacy settings - allow anyone to download'. 'with link' implies some level of security that just isn't there. Even if Google proxy links within the document, there's always the possibility that someone could accidentally send a link to the file to someone, or that someone could shoulder surf it, or even guess it is if it's simple enough.

View on HN

I don't know if that's quite fair. Infeasible to guess urls do have a level of security that's significantly higher than implied by "Remove privacy settings - allow anyone to download".

Yes, someone could shoulder surf it, but we don't tell you that your bank account has no security because someone could shoulder surf you entering your password.

My bank account has 2 factor authentication for that very reason.

If I know your bank's routing number (not a secret) and your account number, I can create a demand draft to take money out of your account. https://en.wikipedia.org/wiki/Demand_draft

What does that have to do with anything? If you issue fraudulent demand drafts, the bank will trace the destination account and send lawyers after you. If you trace referrers and open the origin URL, it's doubtful whether anyone will trace it or have legal recourse against you.

That's not two-factor authentication.

Not guaranteed.

I'm aware of a story where a local credit union assigned account numbers strictly sequentially. A customer setting up direct-withdrawal typo'd their account number by omitting a digit, i.e. their acccount number was '12345' and they entered '1234'.

Since the numbers are sequential, '1234' happened to exist. For about a year, the company in question cheerfully direct-withdrew from the inappropriate account, and the original owner of '1234' never noticed, never complained, or had their complaints ignored. To my knowledge, the error was never rectified.

End of the day, direct-draft is a badly-architected system from a security standpoint.

Yes, but it's reasonable to assume that if I keep a URL secret and it's a very long and complex URL, that nobody will be able to guess it and find the document.

I mean after all, we assume that's true for passwords.

But we're more accepting of someone crawling our site trying random URLs than we are of people trying hundreds of passwords.

Not really. If you try to guess a long and complex URL or a long and complex password you will either move at a glacial pace or DOS the site.

URL-shortened links can be an issue, but raw google docs links have crypto-length randomy numbers.

I've always thought of 'Anyone with the link' as functionally equivalent to 'Anyone.' I will continue to think so after this referrer-header change.

The first time you email that link out, you have technologically released your ability to predict who will view the document (was the e-mail sent over secure channels end-to-end? Did it go to a trusted party who won't reshare it? Did you typo the e-mail address and send it to an undesired party? Did a recipient print it out and leave a printed copy lying around in an accessible conference room? Was the printout shredded after use? Was the shredding functionally irreversible? Is the shredding being done by a third-party that might lose some loads of documents on the way to the shred facility? Did you leave the link in your local machine's pastebuffer then walk away without locking your terminal? Etc., etc., etc.).

Even when the link is functionally unguessable, allowing non-authenticated access is just "security through obscurity."

It provides as much security as you have trust in the people you share it with. If I set one of my documents to "anyone with the link" just so that I can access it when I'm not logged in, and I'm careful to not share the link with anyone else, then I'd argue that it's still provides some security because I trust myself.

If I shared a document with only you (directly, not using the "anyone with the link" permission), I couldn't stop you from taking a screenshot and sending that to whomever you pleased (or printing them out and leaving them in a conference room, like you suggested). Sharing documents online in general can be troubling if you don't trust the people you send them to. It's easier to share a link than share a screenshot, though, and a link would provide continued access going forward, and could remove deniability that the screenshot was faked.

But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the link with.

Whole-document transformation and copying are a concern, but I think that's usually treated as a different category of issue from "The server I trust to store the data securely gave it up to some anonymous person who passed a correctly-formatted request to it because the server can't know any better."

Yes, certainly this particular bug was serious and a real problem that needed to be fixed. The link should not be shared accidentally like that.

I was just making the case that "Anyone with the link" still provides some security. Just like you don't know if the people accessing the document are the ones that you shared the link with, you don't know that the people you shared the document contents themselves with aren't showing others without your knowledge.

Seriously, I'm not surprised that the average user might not grasp this concept (which is why it's good that Google dealt with this referrer issue), but it's bizarre that so many people on this thread don't. When it comes to pictures etc, it's generally prudent to assume "If you post it on Facebook, it's effectively public"; if anything this is even more true for the "anyone with the link" sharing setting.

> there's always the possibility that someone could accidentally send a link to the file to someone

I think that would be implied when the setting says anyone with the link.

It would be the same if I attached the document to a email, someone could still forward the email.

Reply on news.ycombinator.com