Questions tagged [google]
Google is an American multinational corporation which provides Internet-related products and services, including Internet search, cloud computing, software and advertising technologies.
449
questions
1
vote
2answers
102 views
Google searches seen by ISP
When you enter something in the search bar right before it connects to google, can an ISP see that?
3
votes
1answer
95 views
What can an attacker do with credentials.json [duplicate]
A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
0
votes
0answers
78 views
Can Google and Apple read Telegram notifications's body?
When using e2e encryption (secret chats), the answer is obviously no (I hope), but I am talking about NOT e2e-encrypted messages, the ones stored in the cloud.
I am of course aware that the messages ...
0
votes
0answers
40 views
Is it possible to make a Cloudflare Worker out of Google Adsense code? [closed]
Can you make a Cloudflare worker out of Google AdSense code? So that the ads are loaded "on the edge of the cloud"?
1
vote
1answer
73 views
Is there a way to check if Google Drive is scanning folders other than the ones I have synced?
I have a piece of software that monitors C:\Folder1. It keeps it in sync with C:\Folder2. It encrypts everything in C:\Folder2.
I want to sync Folder2 to my Google Drive. But this additional ...
0
votes
1answer
150 views
What is “play security information update”
In my android phone I have random downloading progress started by download manager. The notification says "play security information update". I have no idea if this is a regular android security check ...
0
votes
1answer
61 views
For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?
I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
-2
votes
1answer
143 views
Reason for fake academic pdf files found on sites like Google Scholar? [closed]
Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
-1
votes
1answer
53 views
How Google location changes to a different location [closed]
Does anyone have an idea how it is possible that my phone registers a location I have never been to before?
0
votes
0answers
48 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
4
votes
1answer
139 views
Is restricting a Google API key for an Android app useless?
According to Google, one can add the SHA-1 certificate fingerprint and the name of the package in the Google Developers Console to restrict the usage of his API key to his Android app, so that ...
0
votes
0answers
49 views
Would iCloud data “cross-contaminate” Google account?
Sorry for asking such “wild” sounding question.
Basically, iCloud can be allowed to sync bookmarks to Google Chrome browser through iCloud Windows application. And most of the time, your Chrome ...
2
votes
2answers
389 views
Why does WhatsApp not encrypt Google Drive backups?
WhatsApp has end-to-end encryption, promising privacy to users.
However, it becomes useless if backups to Google Drive are unencrypted. Our supposedly private data goes to the control of Google.
No ...
1
vote
2answers
88 views
Should Google User ID's be hashed when stored in the database
I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods.
I'm basically treating the Google ID and Password as credentials here. I'm already ...
1
vote
1answer
75 views
What are the risks of redirecting my email with Google Domains?
I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
3
votes
1answer
222 views
What's the difference between using duckduckgo with !google bangs and using google directly?
Is there any security advantage in searching on duckduckgo using !google? Or is it effectively the same as searching directly on google?
-2
votes
1answer
92 views
is it possible that an attacker catch a page name from history?
like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
4
votes
2answers
179 views
Is it possible to track/save Google searches that were never submitted?
When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? ...
4
votes
1answer
109 views
Repercussions on Google account used to access a compromised service
Suppose the following scenario:
A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed.
The attacker has sufficient ...
3
votes
0answers
161 views
Can SS7 attacks intercept SMS sent to a Google Voice number?
Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
-4
votes
2answers
141 views
How did Google “decode” my Gsuite password? [closed]
Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems.
But if a hashed password was transmitted to Google when I logged in to my account then how did ...
1
vote
1answer
197 views
How Recaptcha Detect Fake User-Agent
I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no ...
2
votes
1answer
372 views
How did Instagram know the content of my WhatsApp conversation and Google searches?
My friend forwarded me some information about a business via WhatsApp (on mobile). I did some Google searching on that business on a desktop.
I've deactivated my Facebook account for almost a year ...
2
votes
1answer
110 views
Why does Google 2FA not display the correct location when behind proxy?
I'm on my corporate proxy and using Google 2-factor authentication to log into my machine. When I get the notification on my phone, it says that I'm trying to connect from Moscow, Russia, even though ...
0
votes
3answers
119 views
Google Drive and GDPR [closed]
I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
31
votes
6answers
14k views
Why can't I share a one use code with anyone else?
I noticed in some cases when I get a verification code from Google it may say something along the line of:
"You should not share this code with anyone else and no one from Google will ever ask for ...
62
votes
2answers
9k views
How are one-time password generators like Google Authenticator different from having two passwords?
Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
-1
votes
2answers
88 views
Why do so many websites use third-party sites for hosting JavaScripts?
Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
0
votes
1answer
107 views
Hundreds of empty-username logins in Wordpress site
A Wordpress site I manage has the WordFence security plugin installed.
Legitimate users occasionally get blocked by the Brute Force protection aspect of the plugin, even though they haven't made any ...
5
votes
3answers
227 views
What if the Google account login screen is spoofed [duplicate]
I am talking about the apps that allow using my google account for login. Nothing against Postman, just using its login screen for example -
My concern is that an app could be spoofing this whole ...
1
vote
1answer
255 views
How does Google locate me from my laptop?
From this question I learned how Google locates me over BSSIDs.
But how does Google retrieve my WLAN-access-point-BSSID when I use Google's services (maps.google.com for example) in Firefox from a ...
1
vote
1answer
72 views
What accounts for file accessed immediately after including link in Gmail?
Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
0
votes
1answer
128 views
Why does Google still use SHA-1 for securing API keys if its been compromised?
If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017.
If that's the case, then why when you restrict google ...
24
votes
1answer
8k views
False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Every time I log in to Google with the same MacBook I get this email:
New device signed in to
example@gmail.com
Your Google Account was just signed in to from a new Mac device. You're getting ...
1
vote
1answer
126 views
Should I report this Google API key disclosure issue or not?
I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:
https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
44 views
Google's recommendation of server-side authentication over client-side [duplicate]
I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to.
One main problem I ...
1
vote
1answer
111 views
Has it been proven, that Google Home & Alexa do not record before their respective key phrases?
The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers.
However, there have been some court cases, in which ...
1
vote
1answer
129 views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
0
votes
5answers
320 views
Is my Google Drive still secure if Chrome was heavily compromised?
I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
0answers
98 views
Google Home Hub Network Traffic on Port 8009
I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
0
votes
0answers
59 views
On The Use Of Unsanboxed Plugins In The Chrome Browser
The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins.
The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
399 views
Payment Handlers In Google Chrome
Are there any privacy/security risks associated with using payment handlers in Google Chrome?
Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
3
votes
0answers
87 views
Automatic Downloads in Google Chrome [closed]
The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings.
For starters, are there any security risks associated with allowing sites to ask ...
0
votes
2answers
110 views
Private Google account at work
I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
0answers
83 views
Friend got a spam mail with my name and location, after a google drive invite
Right after I sent an invite to a shared drive folder to said friends email adress, she received a spam mail featuring my name (the name I got on google account and my location (city). How does this ...
10
votes
2answers
2k views
Why can I cast to my neighbour's TV on my Wi-Fi?
I've recently noticed that a new device shows up as available to cast to from my android phone when I'm logged on to our home Wi-Fi. It's an LG Sk8100 TV, but as we own no such TV. I'm assuming it's ...
0
votes
1answer
48 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
-7
votes
1answer
670 views
How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]
Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations.
February 9, 2019:
"Seven researchers from all over the world found --yet again-- another
way to break RSA ...
1
vote
0answers
79 views
How is someone accessing my google account? [closed]
Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account ...
2
votes
0answers
298 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
