1

How safe/secure is it to use Google Docs or MS Office online to share data?

That is, if Alice create a new spreadsheet and inserts data into that document and then invites Bob to access that spreadsheet using the sharing function that is built in - can an attacker eavesdrop that process?

I assume that both services uses https so the data is safe when Alice and Bob access it in a browser, but what about the invitation process? Isn't that usually done via an e-mail with a link? And e-mails aren't safe so how do they get around that problem?

1
  • "what about the invitation process? Isn't that usually done via an e-mail with a link?" The built-in sharing function offers two choices -- give access to everyone with the link, or give access to specific accounts. In the latter case, an attacker with the link still has to be able to log in to the cloud account.
    – Ben Voigt
    Commented Dec 21, 2022 at 22:17

1 Answer 1

1

You essentialley gave already the answer: any process is no safer than the people working on it. If you want to narrow it down to the manual "key exchange":

  • obviously you want to protect your data folder by password for access (not only a link anyone can use).
  • Consider independent channels for link and password, such as personal meeting, telephone, mail using at least a different account, post letter.
  • If using email, make sure encryption and authentification settings in your mail clients are state of the art (and educate your co-workers likewise!)
  • In addition, you may agree on file encryption, using a third channel for key exchange.
  • If you are not confined to low level/public cloud w/o the need of various co-workers in different environments beeing able to use it, there are company-level solutions, involving more elaborated authentificaton methods, VPN requirements etc.

In order to get more specific, also recapitulate your thread model and requirements:

  • what kind of data do you share, what is the worst thing to happen incase of a data breach? If you need high security, Google may not be your first joice independent of invitation process of co-workers anyway. Meaningless holiday photos of flowers? Personal data, people faces, geolocation data? Academic research data that does not look too promising, and people who will - possibly - understand it are in a small field and know each other well? Highly competing data?
  • In addition to external Eve - would you be afraid of the cloud provider itself to read the data? Your data may be screened for illicit activities automatically, possible reviewd manually. And there are reports of people getting locked out b/o misinterpretation of really innocent data, resulting in lockout for long time/indefinitely. I.e. loss of data can happen independet of external Eve seeing it.
  • how often do you have to update data? If only rarely and not urgently, you obviously may also use different media than the cloud, e.g. hand over a CD.
  • I feel, discussion of risk of specific exploits for different cloud providers is out of scope of this question.
2
  • Question appears to be about document sharing in a cloud editor, not file sharing.
    – Ben Voigt
    Commented Dec 21, 2022 at 22:19
  • I would add to your first list: enable the feature to be informed when data is modified, providing a basic warning system against data being corrupted. (Won't help as long as data is only being read.) Commented Aug 20, 2023 at 5:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .