Questions tagged [google]
Google is an American multinational corporation which provides Internet-related products and services, including Internet search, cloud computing, software and advertising technologies.
457
questions
0
votes
1answer
27 views
Google Cloud IAM login to linux machines
Is it true that in GCP, accounts that will be used to log in to linux machines can be provisioned in Google Cloud IAM? And if so, how is it achieved (i.e. using directory services or by amending etc ...
0
votes
2answers
70 views
What are the risks from letting users share their own calendars?
I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would ...
0
votes
1answer
29 views
How to encrypt user data in app using Google Sign-In
I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
0
votes
1answer
61 views
Are AWS Signed URL's crawled by google?
I have used Amazon pre signed url to share content.
https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-presigned-urls.html
Is google able to crawl this url? I'm sharing this url with ...
0
votes
0answers
52 views
Google SMS verification codes broken on a loop - should I be concerned?
So this is a little out of the ordinary. Not sure what to make of it.
I've enable 2-Step Verification on a Google account.
When opening mail or other G-related services, it sends an SMS(text message) ...
1
vote
3answers
290 views
What can someone do with a Google auth token?
I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is:
"The exposed data included names, email addresses, genders, spoken
...
0
votes
1answer
83 views
Is there any real protection against Google on Android phones? [closed]
There's a lot one can do to protect his self identity and from being tracked on standard computer machine, but I wonder if there's any way to do so(or at least as close as it possible) on the Android ...
1
vote
0answers
45 views
Privacy implications of GCM on MicroG
GCM (now FCM after a change of ownership to a Google subsidiary) is a push notification framework which is commonly used on Android phones. MicroG is an open source reimplementation of Google ...
0
votes
0answers
46 views
Received Google calendar invite but no organizer?
Whenever my wife and I invite each-other to an event which we create we always see the organizer above the guest but this spam invite does not have one.
How is this possible? Can I achieve this?
1
vote
2answers
134 views
Google searches seen by ISP
When you enter something in the search bar right before it connects to google, can an ISP see that?
3
votes
1answer
105 views
What can an attacker do with credentials.json [duplicate]
A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
0
votes
0answers
82 views
Can Google and Apple read Telegram notifications's body?
When using e2e encryption (secret chats), the answer is obviously no (I hope), but I am talking about NOT e2e-encrypted messages, the ones stored in the cloud.
I am of course aware that the messages ...
1
vote
1answer
90 views
Is there a way to check if Google Drive is scanning folders other than the ones I have synced?
I have a piece of software that monitors C:\Folder1. It keeps it in sync with C:\Folder2. It encrypts everything in C:\Folder2.
I want to sync Folder2 to my Google Drive. But this additional ...
0
votes
1answer
940 views
What is “play security information update”
In my android phone I have random downloading progress started by download manager. The notification says "play security information update". I have no idea if this is a regular android security check ...
0
votes
1answer
61 views
For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?
I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
-2
votes
1answer
144 views
Reason for fake academic pdf files found on sites like Google Scholar? [closed]
Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
-1
votes
1answer
53 views
How Google location changes to a different location [closed]
Does anyone have an idea how it is possible that my phone registers a location I have never been to before?
0
votes
0answers
53 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
5
votes
1answer
201 views
Is restricting a Google API key for an Android app useless?
According to Google, one can add the SHA-1 certificate fingerprint and the name of the package in the Google Developers Console to restrict the usage of his API key to his Android app, so that ...
0
votes
0answers
49 views
Would iCloud data “cross-contaminate” Google account?
Sorry for asking such “wild” sounding question.
Basically, iCloud can be allowed to sync bookmarks to Google Chrome browser through iCloud Windows application. And most of the time, your Chrome ...
2
votes
2answers
548 views
Why does WhatsApp not encrypt Google Drive backups?
WhatsApp has end-to-end encryption, promising privacy to users.
However, it becomes useless if backups to Google Drive are unencrypted. Our supposedly private data goes to the control of Google.
No ...
1
vote
2answers
95 views
Should Google User ID's be hashed when stored in the database
I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods.
I'm basically treating the Google ID and Password as credentials here. I'm already ...
1
vote
1answer
77 views
What are the risks of redirecting my email with Google Domains?
I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
3
votes
1answer
231 views
What's the difference between using duckduckgo with !google bangs and using google directly?
Is there any security advantage in searching on duckduckgo using !google? Or is it effectively the same as searching directly on google?
-2
votes
1answer
94 views
is it possible that an attacker catch a page name from history?
like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
4
votes
2answers
190 views
Is it possible to track/save Google searches that were never submitted?
When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? ...
4
votes
1answer
112 views
Repercussions on Google account used to access a compromised service
Suppose the following scenario:
A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed.
The attacker has sufficient ...
3
votes
0answers
201 views
Can SS7 attacks intercept SMS sent to a Google Voice number?
Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
-4
votes
2answers
157 views
How did Google “decode” my Gsuite password? [closed]
Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems.
But if a hashed password was transmitted to Google when I logged in to my account then how did ...
1
vote
1answer
428 views
How Recaptcha Detect Fake User-Agent
I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no ...
2
votes
1answer
380 views
How did Instagram know the content of my WhatsApp conversation and Google searches?
My friend forwarded me some information about a business via WhatsApp (on mobile). I did some Google searching on that business on a desktop.
I've deactivated my Facebook account for almost a year ...
2
votes
1answer
111 views
Why does Google 2FA not display the correct location when behind proxy?
I'm on my corporate proxy and using Google 2-factor authentication to log into my machine. When I get the notification on my phone, it says that I'm trying to connect from Moscow, Russia, even though ...
0
votes
3answers
134 views
Google Drive and GDPR [closed]
I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
31
votes
6answers
14k views
Why can't I share a one use code with anyone else?
I noticed in some cases when I get a verification code from Google it may say something along the line of:
"You should not share this code with anyone else and no one from Google will ever ask for ...
62
votes
2answers
9k views
How are one-time password generators like Google Authenticator different from having two passwords?
Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
-1
votes
2answers
93 views
Why do so many websites use third-party sites for hosting JavaScripts?
Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
0
votes
1answer
109 views
Hundreds of empty-username logins in Wordpress site
A Wordpress site I manage has the WordFence security plugin installed.
Legitimate users occasionally get blocked by the Brute Force protection aspect of the plugin, even though they haven't made any ...
6
votes
3answers
258 views
What if the Google account login screen is spoofed [duplicate]
I am talking about the apps that allow using my google account for login. Nothing against Postman, just using its login screen for example -
My concern is that an app could be spoofing this whole ...
1
vote
1answer
299 views
How does Google locate me from my laptop?
From this question I learned how Google locates me over BSSIDs.
But how does Google retrieve my WLAN-access-point-BSSID when I use Google's services (maps.google.com for example) in Firefox from a ...
1
vote
1answer
72 views
What accounts for file accessed immediately after including link in Gmail?
Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
0
votes
1answer
144 views
Why does Google still use SHA-1 for securing API keys if its been compromised?
If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017.
If that's the case, then why when you restrict google ...
24
votes
1answer
8k views
False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Every time I log in to Google with the same MacBook I get this email:
New device signed in to
example@gmail.com
Your Google Account was just signed in to from a new Mac device. You're getting ...
1
vote
1answer
157 views
Should I report this Google API key disclosure issue or not?
I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:
https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
45 views
Google's recommendation of server-side authentication over client-side [duplicate]
I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to.
One main problem I ...
1
vote
1answer
113 views
Has it been proven, that Google Home & Alexa do not record before their respective key phrases?
The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers.
However, there have been some court cases, in which ...
1
vote
1answer
150 views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
0
votes
5answers
323 views
Is my Google Drive still secure if Chrome was heavily compromised?
I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
0answers
117 views
Google Home Hub Network Traffic on Port 8009
I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
0
votes
0answers
85 views
On The Use Of Unsanboxed Plugins In The Chrome Browser
The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins.
The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
692 views
Payment Handlers In Google Chrome
Are there any privacy/security risks associated with using payment handlers in Google Chrome?
Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
