3

I thought Google Drive was more secure than this.

If I upload a photo to Google Drive, I don't care that it's entrusted to them and I also assume someone working there can look at it. No big deal. However, for the rest of the world, I assume my photo is safe short of someone getting my password and logging into my account.

I opened my image while in the network tab inspecting traffic and I found that the image pulls from a secondary location:

https://lh3.googleusercontent.com/zXJGmFXf9unQUTbiHYijvzlD1itVOsfRSKnO2GHc64D1s7HbAUl_T16qfTPiH8vJvjhoKA=w1886-h513

This is an image shared with no one but myself on Google Drive. Anyone capable of inspecting network traffic can intercept that image by its googleusercontent address as it bypasses my login authority.

So, there's the public version of the private document hosted on googleusercontent.com, and there's the private version hosted on drive.google.com

Google Drive doesn't even seem like a reasonably secure option for my data, even though they claim "Your files are private unless you choose to share them."
source: Is Google Drive secure?

My files don't seem all that private from someone inspecting network traffic.

But, I must be missing something. What am I not understanding? I tried to find that address that exposes my image with Wireshark but got lost in details. How does a network snoop view the request generated to googleusercontent as I see it generated in my network tab in the browser when I open the 'private' photo in Google Drive?

Improve this question
3
  • The connection is over HTTPS so someone snooping on the network would see a request to googleusercontent.com but would not see the rest (i.e. they don't see the zXJG....).
    – puzzlepalace
    Apr 21, 2016 at 16:37
  • @drewbenn No, the image would be encrypted while on the network.
    – puzzlepalace
    Apr 21, 2016 at 16:40
  • @drewbenn My understanding based on Jeff's answer below is that this url from lh3.googleusercontent.com is protected from view except to me and Google as it exists inside of an HTTPS transaction. It's exposed in my question only because I copied it out of a secure session. Other than that, all the photos on Google Drive turn out to have a default permission of "Anyone with the link can view."
    – ThisClark
    Apr 21, 2016 at 17:15

1 Answer 1

Reset to default
7

Anyone capable of inspecting network traffic can intercept that image by its googleusercontent address as it bypasses my login authority.

Not quite. As it's HTTPS, only someone who knows the private key in use (should only be you and google) are privy to the whole URL. Now, it is vulnerable to things like browser history attacks (anyone looking at your history can know it since your browser doesn't do anything to obfuscate it) and a few other perils, but it isn't readily available to a casual bystander.

Thinking of guessing the URL? There are ~ 70 chars in the URL which yields 390 bits of entropy, guessing at it is definitely not practical unless you can find some weaknesses (i.e. if it's not truly random) otherwise in order to find even one actual picture would take over a billion years of attempts (assuming they have billions of images inhouse) and additionally finding a particular users' photos via guessing is completely impossible.

I could not recreate access to your URL (it gave a 404 error identical to using a guessed URL), I suspect that the image and/or thumbnail (whatever is created and put there) is in-memory or in some similarly short lived state, probably gone within an hour or less.

Improve this answer
8
  • So all the individual GET requests in the network tab are secure when I'm using a secure document that fetches more resources?
    – ThisClark
    Apr 21, 2016 at 16:41
  • 1
    Absolutely, the only thing visible in the clear in a HTTPS session is the hostname you use to refer to the server (used to initiate the request) and everything after that is completely hidden from view. This explains why your attempt to casually browse it with Wireshark didn't yield the content you expected.
    – Jeff Meden
    Apr 21, 2016 at 16:43
  • Also just to take a step back to the premise, did you try to duplicate the access to the image by taking the URL to a completely foreign computer and downloading the file? --nevermind, I found what youre talking about, its the thumbnail that gets offloaded to googleusercontent.com and is available without auth.
    – Jeff Meden
    Apr 21, 2016 at 16:47
  • Right - all our private photos have corresponding public links but unless the https session is protecting network traffic internally and it can't be detected by others on the network, then the only way they can get it is by guessing the URL such as the one I linked to in my question.
    – ThisClark
    Apr 21, 2016 at 17:11
  • Having noticed that it's just the thumbnails, I think that it generates those on the fly (the resulting image on googleusercontent.com is dependent on the thumb size setting you choose) and I would bet that they don't even exist until you go looking for them (of course theres no way to prove this). I would be interested to see if they still reside at the same URL a day later.
    – Jeff Meden
    Apr 21, 2016 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .