2

I have recently seen many people use Google Forms as a way of sharing “passcode protected” information. They seem to have the first section of the form with a required field asking for a short piece of text (the “password”), and if the inputted text does not exactly match the required text, it gives you a custom error message telling you the “password” is incorrect. The second section of the form is the secret information, which you can’t see until you put in the correct “password” from the first form section. You don’t log in with a Google account either.

I’ve seen many schools use this as a way to share Zoom Meeting IDs and passwords with students. While it superficially seems to work well enough for most people, is this really a safe way of protecting private information? For example, are people who use Google forms to passcode protect information safe from things such as brute-force attacks? I’m fairly sure the “passwords” being used aren’t strong either.

2
  • The example given is protecting a simple password (and perhaps meeting ID) with a simple password. Therefore, regardless of Google Forms security, this doesn’t seem to enhance security. If the form location and password can be shared securely, why can’t the Zoom details? The only exception I can think of would be when the Google afore is locked to users of a certain organisation. But in this case alternative solutions like Google Calendar, Docs or Gmail seem to be more user friendly.
    – David
    Nov 22 '20 at 23:19
  • @David it could be one password to a directory of many meetings/lectures, so a convenience thing assumed (wrongly) to be adequately secure
    – Chris H
    Nov 23 '20 at 12:51
6

No, this is not secure at all. You don't even need to brute force anything. Both the password and the secret are right there in the source code of the form page. All you have to do is to use the "inspect" or "view page source" feature of your browser in order to see it. You can easily test this yourself by creating a form with a "password" and a "secret" and then doing a search in the source code of the form for the secret. The input validation feature isn't designed to be used for password protecting data, so it shouldn't be used this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.