Questions tagged [google]
Google is an American multinational corporation which provides Internet-related products and services, including Internet search, cloud computing, software and advertising technologies.
1
vote
2answers
91 views
Why does WhatsApp not encrypt Google Drive backups?
WhatsApp has end-to-end encryption, promising privacy to users.
However, it becomes useless if backups to Google Drive are unencrypted. Our supposedly private data goes to the control of Google.
No ...
1
vote
2answers
70 views
Should Google User ID's be hashed when stored in the database
I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods.
I'm basically treating the Google ID and Password as credentials here. I'm already ...
1
vote
1answer
70 views
What are the risks of redirecting my email with Google Domains?
I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
3
votes
1answer
173 views
What's the difference between using duckduckgo with !google bangs and using google directly?
Is there any security advantage in searching on duckduckgo using !google? Or is it effectively the same as searching directly on google?
-2
votes
1answer
90 views
is it possible that an attacker catch a page name from history?
like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
4
votes
2answers
159 views
Is it possible to track/save Google searches that were never submitted?
When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? ...
4
votes
1answer
104 views
Repercussions on Google account used to access a compromised service
Suppose the following scenario:
A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed.
The attacker has sufficient ...
2
votes
0answers
115 views
Can SS7 attacks intercept SMS sent to a Google Voice number?
Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
-4
votes
2answers
131 views
How did Google “decode” my Gsuite password? [closed]
Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems.
But if a hashed password was transmitted to Google when I logged in to my account then how did ...
1
vote
1answer
92 views
How Recaptcha Detect Fake User-Agent
I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no ...
2
votes
1answer
348 views
How did Instagram know the content of my WhatsApp conversation and Google searches?
My friend forwarded me some information about a business via WhatsApp (on mobile). I did some Google searching on that business on a desktop.
I've deactivated my Facebook account for almost a year ...
0
votes
0answers
39 views
How to set LastPass to verify before opening my vault and viewing all passwords [migrated]
I am new to LastPass and I was shocked when I realised that, once I logged in to LastPass browser extension, I could open my vault and view all the passwords even after I had exited my browser and ...
2
votes
1answer
93 views
Why does Google 2FA not display the correct location when behind proxy?
I'm on my corporate proxy and using Google 2-factor authentication to log into my machine. When I get the notification on my phone, it says that I'm trying to connect from Moscow, Russia, even though ...
0
votes
3answers
112 views
Google Drive and GDPR [closed]
I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
31
votes
6answers
14k views
Why can't I share a one use code with anyone else?
I noticed in some cases when I get a verification code from Google it may say something along the line of:
"You should not share this code with anyone else and no one from Google will ever ask for ...
62
votes
2answers
9k views
How are one-time password generators like Google Authenticator different from having two passwords?
Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
-1
votes
2answers
85 views
Why do so many websites use third-party sites for hosting JavaScripts?
Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
0
votes
1answer
91 views
Hundreds of empty-username logins in Wordpress site
A Wordpress site I manage has the WordFence security plugin installed.
Legitimate users occasionally get blocked by the Brute Force protection aspect of the plugin, even though they haven't made any ...
5
votes
3answers
210 views
What if the Google account login screen is spoofed [duplicate]
I am talking about the apps that allow using my google account for login. Nothing against Postman, just using its login screen for example -
My concern is that an app could be spoofing this whole ...
1
vote
1answer
242 views
How does Google locate me from my laptop?
From this question I learned how Google locates me over BSSIDs.
But how does Google retrieve my WLAN-access-point-BSSID when I use Google's services (maps.google.com for example) in Firefox from a ...
1
vote
1answer
71 views
What accounts for file accessed immediately after including link in Gmail?
Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
0
votes
1answer
107 views
Why does Google still use SHA-1 for securing API keys if its been compromised?
If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017.
If that's the case, then why when you restrict google ...
24
votes
1answer
7k views
False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Every time I log in to Google with the same MacBook I get this email:
New device signed in to
example@gmail.com
Your Google Account was just signed in to from a new Mac device. You're getting ...
1
vote
1answer
112 views
Should I report this Google API key disclosure issue or not?
I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:
https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
41 views
Google's recommendation of server-side authentication over client-side [duplicate]
I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to.
One main problem I ...
1
vote
1answer
107 views
Has it been proven, that Google Home & Alexa do not record before their respective key phrases?
The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers.
However, there have been some court cases, in which ...
1
vote
1answer
109 views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
0
votes
5answers
312 views
Is my Google Drive still secure if Chrome was heavily compromised?
I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
0answers
74 views
Google Home Hub Network Traffic on Port 8009
I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
0
votes
0answers
47 views
On The Use Of Unsanboxed Plugins In The Chrome Browser
The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins.
The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
200 views
Payment Handlers In Google Chrome
Are there any privacy/security risks associated with using payment handlers in Google Chrome?
Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
3
votes
0answers
85 views
Automatic Downloads in Google Chrome [closed]
The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings.
For starters, are there any security risks associated with allowing sites to ask ...
0
votes
2answers
81 views
Private Google account at work
I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
0answers
81 views
Friend got a spam mail with my name and location, after a google drive invite
Right after I sent an invite to a shared drive folder to said friends email adress, she received a spam mail featuring my name (the name I got on google account and my location (city). How does this ...
10
votes
2answers
1k views
Why can I cast to my neighbour's TV on my Wi-Fi?
I've recently noticed that a new device shows up as available to cast to from my android phone when I'm logged on to our home Wi-Fi. It's an LG Sk8100 TV, but as we own no such TV. I'm assuming it's ...
0
votes
1answer
37 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
-6
votes
1answer
519 views
How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]
Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations.
February 9, 2019:
"Seven researchers from all over the world found --yet again-- another
way to break RSA ...
1
vote
0answers
69 views
How is someone accessing my google account? [closed]
Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account ...
2
votes
0answers
249 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
123 views
Why is it recommended to use GCP service accounts vs user accounts?
I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
1
vote
1answer
385 views
How would google know someone has the password for my web host email?
I received a confusing email from Google today. It had the subject 'Critical security alert' and the body said in part 'Google has become aware that someone else knows your password, and we've taken ...
1
vote
1answer
743 views
'Critical security alert for your linked Google Account ' but I don't recognize the account
I received an email entitled : 'Critical security alert for your linked Google Account' .. The body says:
Someone knows the password to your linked Google Account
----------@gmail.com
...
0
votes
1answer
120 views
why does google.com redirect if URL contains /amp followed by a schemeless domain name and optional resource?
Google recently announced a 'quiz' - more of a tutorial - on identifying phishing email: https://phishingquiz.withgoogle.com
It includes a sample URL: https://google.com/amp/tiny url.com/y7u8ewlr
...
2
votes
2answers
117 views
A (spoofed?) trusted device has logged in from an unrecognized location
Recently my google account was hacked. I have 2-factor authentication turned on. 2-factor authentication was not required for the hacker to gain access to my account, nor did the hacker trigger Google'...
0
votes
2answers
122 views
How to check Google SSL certificate?
I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine.
I wonder, how do I know the certificate I have is legit? That is, ...
1
vote
2answers
90 views
When pasting sensitive links or text on Google Chrome bar - does Google store it?
When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google.
Does Google store all of them, including that sensitive information?
0
votes
1answer
198 views
How does Google Authenticator interact with apps on an iPhone?
I am clear on how Google Authenticator works when logging on to a website and I am clear on that.
However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
0
votes
2answers
149 views
How does Google crawl pages which require login?
I queries a phrase on Google, and when I clicked on the first result, it asked me to login, and wasn't allowing me to proceed without login.
If it matters, the query that I searched was "how to exit ...
1
vote
0answers
57 views
Does Google Analytics maintain a database of IP addresses that visited a webpage? [closed]
I am attempting to balance my need for analytics with privacy concerns. I know that Google Analytics offers an IP anonymization feature to remove the last octet of visitors' IP addresses, should a ...
0
votes
0answers
19 views
Can a limited permission Chrome extension access multidomain cookies?
Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account?
(Background: The sign in window is hosted at a different ...
