2

I am trying to run Google Drive on LUbuntu 64 bit, but since there isn't an official version yet, I was thinking to follow this tutorial.
Since it's not an official software from Google, I am concerned about them seeing, copying, sharing, etc. my data. Should I trust them by following that tutorial and syncing my files using this software?

  • @DanielRuf I'm looking at the source code right now, it's an oAuth type authentication using cURL to communicate via REST using the official API. Here's something a little alarming; The client secret for the app bl4ufi89h-9MkFlypcI7R785 – Jonathan Gray Dec 5 '15 at 18:54
4

I would not trust the application. The client secret bl4ufi89h-9MkFlypcI7R785 is embedded directly into the application. If you allow this application to be trusted by your Google account, then any permissions you give the app will be inherently granted to anyone who decides to maliciously make use of the client secret together with the client ID. Furthermore, the client secret leak breaks a layer of protection designed to ensure the legitimacy of the communicating server.

Click here to view the main source code file containing the client secret.

  • You mean github.com/vitalif/grive2/blob/… – Daniel Ruf Dec 5 '15 at 19:12
  • @DanielRuf Edited my answer – Jonathan Gray Dec 5 '15 at 19:13
  • At least it is not a secret and it is a constant in the sourcecode. You are right. A corresponding issue should be created on GitHub. I know that there needs to be a client secret and client ID to create an app, but these should never be given to other users and be different for every user. This means every user should register their own client ID for the Google REST API. – Daniel Ruf Dec 5 '15 at 19:25
  • @JonathanGray Thanks to all of you! The sad thing is that I feel like Grive is pretty famous: there are many articles and pages that recommend it. I hope that my question will save others from trouble. Is there an alternative to Grive, that you suggest me and that it's "safe"? Should I open another question for this? – Aurelius Dec 5 '15 at 21:09
  • @FormlessCloud You can still use Grive and workaround this security flaw if you want to go through all of the trouble. You would need to download the source code of Grive and sign up as a developer (through Google) to create an app for use with the Google Drive REST API. You will receive an app ID and an app secret. Take this information and modify the file in the Grive source code that you downloaded (you can see exactly where and in which file in the link in my answer). Then compile the application from source and you should end up with an executable file that you can run. But it's not easy. – Jonathan Gray Dec 5 '15 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.