Questions tagged [google]
Google is an American multinational corporation which provides Internet-related products and services, including Internet search, cloud computing, software and advertising technologies.
1
vote
1answer
84 views
Should I report this Google API key disclosure issue or not?
I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:
https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
40 views
Google's recommendation of server-side authentication over client-side [duplicate]
I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to.
One main problem I ...
1
vote
1answer
103 views
Has it been proven, that Google Home & Alexa do not record before their respective key phrases?
The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers.
However, there have been some court cases, in which ...
1
vote
1answer
90 views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
0
votes
5answers
293 views
Is my Google Drive still secure if Chrome was heavily compromised?
I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
0answers
46 views
Google Home Hub Network Traffic on Port 8009
I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
0
votes
0answers
38 views
On The Use Of Unsanboxed Plugins In The Chrome Browser
The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins.
The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
73 views
Payment Handlers In Google Chrome
Are there any privacy/security risks associated with using payment handlers in Google Chrome?
Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
3
votes
0answers
82 views
Automatic Downloads in Google Chrome [closed]
The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings.
For starters, are there any security risks associated with allowing sites to ask ...
0
votes
2answers
70 views
Private Google account at work
I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
0answers
75 views
Friend got a spam mail with my name and location, after a google drive invite
Right after I sent an invite to a shared drive folder to said friends email adress, she received a spam mail featuring my name (the name I got on google account and my location (city). How does this ...
10
votes
2answers
559 views
Why can I cast to my neighbour's TV on my Wi-Fi?
I've recently noticed that a new device shows up as available to cast to from my android phone when I'm logged on to our home Wi-Fi. It's an LG Sk8100 TV, but as we own no such TV. I'm assuming it's ...
0
votes
1answer
34 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
-7
votes
1answer
297 views
How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]
Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations.
February 9, 2019:
"Seven researchers from all over the world found --yet again-- another
way to break RSA ...
1
vote
0answers
55 views
How is someone accessing my google account? [closed]
Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account ...
1
vote
0answers
143 views
Using Google Authentication with Lambda@Edge and S3 Static Sites
I am looking to set up authentication on an S3 hosted static site. The configuration is:
S3 bucket configured to allow access via cloudfront
AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
60 views
Why is it recommended to use GCP service accounts vs user accounts?
I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
1
vote
1answer
272 views
How would google know someone has the password for my web host email?
I received a confusing email from Google today. It had the subject 'Critical security alert' and the body said in part 'Google has become aware that someone else knows your password, and we've taken ...
1
vote
1answer
537 views
'Critical security alert for your linked Google Account ' but I don't recognize the account
I received an email entitled : 'Critical security alert for your linked Google Account' .. The body says:
Someone knows the password to your linked Google Account
----------@gmail.com
...
0
votes
1answer
80 views
why does google.com redirect if URL contains /amp followed by a schemeless domain name and optional resource?
Google recently announced a 'quiz' - more of a tutorial - on identifying phishing email: https://phishingquiz.withgoogle.com
It includes a sample URL: https://google.com/amp/tiny url.com/y7u8ewlr
...
2
votes
2answers
116 views
A (spoofed?) trusted device has logged in from an unrecognized location
Recently my google account was hacked. I have 2-factor authentication turned on. 2-factor authentication was not required for the hacker to gain access to my account, nor did the hacker trigger Google'...
0
votes
2answers
110 views
How to check Google SSL certificate?
I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine.
I wonder, how do I know the certificate I have is legit? That is, ...
1
vote
2answers
89 views
When pasting sensitive links or text on Google Chrome bar - does Google store it?
When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google.
Does Google store all of them, including that sensitive information?
0
votes
1answer
97 views
How does Google Authenticator interact with apps on an iPhone?
I am clear on how Google Authenticator works when logging on to a website and I am clear on that.
However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
0
votes
2answers
138 views
How does Google crawl pages which require login?
I queries a phrase on Google, and when I clicked on the first result, it asked me to login, and wasn't allowing me to proceed without login.
If it matters, the query that I searched was "how to exit ...
1
vote
0answers
55 views
Does Google Analytics maintain a database of IP addresses that visited a webpage? [closed]
I am attempting to balance my need for analytics with privacy concerns. I know that Google Analytics offers an IP anonymization feature to remove the last octet of visitors' IP addresses, should a ...
0
votes
0answers
19 views
Can a limited permission Chrome extension access multidomain cookies?
Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account?
(Background: The sign in window is hosted at a different ...
0
votes
1answer
305 views
Got “Security alert” e-mail from Google about a sign-in from an unknown device I'd like to track down [closed]
I just got a horrifying e-mail from Google that led to a webpage stating that there was a "New sign-in on LG Nexus 5". I immediately scrambled to change all my passwords to protect myself because I ...
2
votes
1answer
104 views
Websites that can connect with Gmail
I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login.
Looking at the Google API, ...
1
vote
2answers
548 views
How secure is the fingerprint sensor in the Pixel 3?
As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated.
How ...
3
votes
2answers
105 views
Android Security - Giving Google Your Phone Number
While setting up my Android account on my phone, I am asked
If you like, you can add this phone's number to your account ....
..for example you number will be used to:
Reset your password ...
0
votes
1answer
98 views
Why does Google say my password is weak when I only added a division sign after a bunch of random stuff?
I noticed something very interesting after trying to charge my password for a Google account of mines, it seems strange.
I went to the Google security control panel and selected to change my password ...
-1
votes
1answer
72 views
Does Google Chrome collect data unrelated to browsing activity?
I'm exclusively running Firefox, but I'd like to install the leading browser Chrome for troubleshooting purposes. Browsing-related data collection isn't a concern in this case, but I'm worried if the ...
1
vote
0answers
65 views
Working with Security Metadata in APK file
According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
2
votes
0answers
87 views
Disable Google API key without access to google account
I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
8
votes
2answers
174 views
Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?
According to the Google information page here: https://support.google.com/accounts/answer/6103523
If you don’t have another second step or forgot your password
Note:
2-Step Verification ...
1
vote
0answers
18 views
Google search results hijacked locally / displaying moot in all browsers [duplicate]
So, since yesterday I have quite obviously caught something that Windows Defender doesn't recognize.
Symptoms:
All Google services suffer from Ad injection (non-YouTube ad overlays that cannot be ...
0
votes
1answer
406 views
Google certificate gcp.gvt2.com untrusted / expired?
My antivirus noted gcp.gvt2.com certificate is expired today, gvt2.com alegently used by google analytics.
It might to do with Google distrust of Symantec https://security.googleblog.com/2018/03/...
0
votes
1answer
95 views
Unknown URL parameters in google query
I received an email which is classified as "potentially malicious" by my email program (Thunderbird), where links are actually a google URL query with extra parameters:
For example, the displayed ...
3
votes
1answer
97 views
Google login button - what prevents an rogue app from stealing a token?
Here are steps to setup a Google login button on a web client:
https://developers.google.com/identity/sign-in/web/sign-in
When click on the Google login button this pops up:
All the interactions are ...
1
vote
1answer
259 views
Does Google flag all subdomains for malware/phishing if one is infected?
After I tried logging to my host's cpanel today, I got the safe browsing warning, about the site "redirecting users to harmful websites".
The cpanel uses an address like this:
https://subdomainXX....
1
vote
0answers
28 views
How large is AppEngine's Private Key?
AppEngine provides methods for signing binary data - e.g. via the Go language's SignBytes[1]
However, it doesn't specify any information about how large the private key is.
Is this published ...
4
votes
2answers
1k views
How does Google protect against scraping?
I'm trying to implement security against scraping on my website to prevent basic scraping techniques.
Google seems to have a very good protection against scraping, but it's so good that I'm unable to ...
2
votes
1answer
110 views
Concerted attack on linked google accounts?
Yesterday I received two (authentic) e-mails from Google saying they prevented sign-in attempts to two (very old) google accounts of mine. Google says they used the correct passwords, which turned out ...
1
vote
2answers
406 views
Does Google identify me from my 'phone?
As per my previous question I would like to escape Google as much as possible.
Since I realize that I can’t do this completely, I will do what I can, although some might find it pointless.
I have ...
5
votes
2answers
1k views
By using reCAPTCHA which information is Google collecting?
Wanting to avoid bots registering on a website, I might use reCAPTCHA by Google. Since the algorithm behind reCAPTCHA is not open source, I'm wondering what user information they actually collect ...
0
votes
1answer
50 views
Does facebook/google app id need to keep secret if possible?
For example, suppose I have an app which includes a link to use the facebook feed dialog, eg:
https://www.facebook.com/dialog/feed?app_id=xxxxx&link=
Which means the Facebook id is revealed to ...
2
votes
0answers
74 views
Minimum set of ACS features to secure remote PCIe devices
According to a Google blog post, Google has been experimenting with providing raw access to PCIe devices in a remote environment. They set out to discover what Access Control Service features (ACS, ...
0
votes
0answers
152 views
In google OAuth callback, is providing redirect_uri by client a security risk?
for example, at callback url of google oauth,to convert 'code' to access_token, I need:
Client side href:
https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%...
0
votes
2answers
256 views
How does google know if I am logging in from a new machine(using web browser)? [duplicate]
Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
