Is using Google Forms to share “passcode protected” information safe from brute force attacks?

Question

I have recently seen many people use Google Forms as a way of sharing “passcode protected” information. They seem to have the first section of the form with a required field asking for a short piece of text (the “password”), and if the inputted text does not exactly match the required text, it gives you a custom error message telling you the “password” is incorrect. The second section of the form is the secret information, which you can’t see until you put in the correct “password” from the first form section. You don’t log in with a Google account either.

I’ve seen many schools use this as a way to share Zoom Meeting IDs and passwords with students. While it superficially seems to work well enough for most people, is this really a safe way of protecting private information? For example, are people who use Google forms to passcode protect information safe from things such as brute-force attacks? I’m fairly sure the “passwords” being used aren’t strong either.

Answer 1

No, this is not secure at all. You don't even need to brute force anything. Both the password and the secret are right there in the source code of the form page. All you have to do is to use the "inspect" or "view page source" feature of your browser in order to see it. You can easily test this yourself by creating a form with a "password" and a "secret" and then doing a search in the source code of the form for the secret. The input validation feature isn't designed to be used for password protecting data, so it shouldn't be used this way.