38
votes
Can IT see my Google Drive traffic?
The answer is no and yes too.
Why no: It's a HTTPS traffic and firewalls these days have application identification or deep packet inspection (whatever you call it). That will identify the ...
- 449
24
votes
Accepted
What is the point of restricting a google API key by HTTP referer?
All security measures are trade offs. Is the cost of the control worth more or less than the value of what is being protected, and how much more work does it force the attacker to do.
A lock on your ...
- 1,962
7
votes
What is the point of restricting a google API key by HTTP referer?
The "referer" is set by the browser to contain the address of the calling site, so if you restrict access to the google api by only allowing your web site address, you are preventing other people from ...
- 171
6
votes
Accepted
Why would distributing via Google Play be more secure than distributing APKs?
First and foremost, publishing an APK on your website encourages bad security practices on the user's part. In my opinion you should be encouraging the average user to trust only the Google Play ...
- 1,158
6
votes
Why would distributing via Google Play be more secure than distributing APKs?
One of the best security practices is keeping your software up to date. With the Google Play Store, you can set your installed apps to update automatically (if this isn't already set by default).
To ...
5
votes
What is the point of restricting a google API key by HTTP referer?
What is the point of restricting a google API key by HTTP referer?
A web application cannot easily forge its referrer when issuing requests. Therefore, restricting allowed referrers to a specific ...
- 45.1k
5
votes
Are all Google app-passwords equal? What is their attack scope?
Google hasn't publicly disclosed the scope of app passwords, but there are a few things we can reasonably deduce about them.
One way is to review Google's help information about them. Note especially ...
- 9,717
4
votes
Can IT see my Google Drive traffic?
If your traffic is HTTPS, the content of packets will not be visible.
They would see generic traffic out to google docs, but no definite data will be readable from the traffic.
They will know you ...
- 49
4
votes
Why would distributing via Google Play be more secure than distributing APKs?
When you use Google Play to distribute your app, you declare that you comply with Google's Content Policy, which means that the app is safer for the end users in many ways, including some security ...
- 858
4
votes
sealed data from a stolen laptop
... who doesn't have time for a drive encryption project
Given that most modern systems support drive encryption out of the box or this can easily added, this arguments sounds weak to me.
Apart from ...
- 208k
3
votes
Distribute Program with Sheets API Credentials
I am a Google GDE Cloud Platform, security is my specialty.
The credentials.json file that you mention contains the Client ID and Client Secret. With this credential file, an attacker can create ...
- 350
2
votes
Accepted
Can Google Docs be used to “sanitize” a Word or Excel document?
The strategy you propose might indeed break malicious code, but with 0 day exploits there is no way to be sure.
If it is just the flat text that you want, the safest way to go might be to open the ...
- 76
2
votes
Can a google form contain a virus or other malware?
A Google form is a page hosted by Google to collect information from sources in text boxes, radio buttons etc. We cannot say that it is 100% secure but it is highly unlikely that you will get infected ...
- 1,366
2
votes
Can Google Policy Profile remotely erase all data on the device?
The short answer is "Yes".
If the phone given to you is a "company phone", you must comply.
If this is your phone, as the message mentioned, you must contact your company IT to check out the ...
- 2,417
2
votes
Accepted
Would it be a big security vulnerability if someone wrote a browser extension to retrieve personal information on Google's behalf?
It would be a security vulnerability, yes.
Executing javascript code in the context of a web page allows that code more or less full access to the content of the page, in this case Google Drive. Such ...
- 17.6k
2
votes
Distribute Program with Sheets API Credentials
As other's have mentioned, the credentials.json file gives access to your account. It's not something you want to share with people. However there are two points worth clarifying:
Publishing it ...
- 31.7k
1
vote
Can one trust OS and apps from Onyx: app store, modified Android, Onyx Cloud
I think this is a personal question, and I doubt anyone can give you a definitive answer. Only you can decide whether you trust a company which offers a certain service, and this in turn depends on ...
- 1,947
1
vote
Accepted
Where to store pydrive secret?
If the Raspberry Pi needs access to your google drive to store your video feed then, well, that means that your Raspberry Pi needs access to your google drive and therefore anyone who gains access to ...
- 31.7k
1
vote
Accepted
Google Location Accuracy datafeed
I wonder if Location Accuracy has also the purpose of feeding new
locations of accesspoints to Google.
Yes,When you select the option to pin point you they use a wide variety of things.When it does ...
- 3,814
1
vote
What are the risks from letting users share their own calendars?
I think one should consider what type of information can be contained in calendar entries. Just as an example, what if there is an internal meeting about a vulnerability report, where the meeting ...
- 136
1
vote
What are the risks from letting users share their own calendars?
But the risk would be manageable by the individual users ...
"Would be" is very different from "will be". Users are also capable of choosing strong and unique passwords but they rarely do because it ...
- 208k
1
vote
Are spam invites on Google calendar dangerous?
it is not dangerous unless you open a link, or open any kind of attachments. of course vulnerability in Google calendar is another issue. (like zero-day exploits that are out of your hands).
in ...
- 29
1
vote
Is there a way to check if Google Drive is scanning folders other than the ones I have synced?
You can use Process Monitor. This was developed by Mark Russinovich and was then bought out by Microsoft who gave Russinovich a job.
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
...
- 1,209
1
vote
Google Drive and GDPR
This is article 6, lawfulness of processing:
Processing shall be lawful only if and to the extent that at least one of the following applies:
the data subject has given consent to the ...
- 15.9k
1
vote
What are the risks of visiting someone else's Google Photo while logged in?
Google will log your IP address and device type, then set or check some cookies to identify your device and see if you are signed in with a Google Account.
If you are concerned about being tracked by ...
- 11
1
vote
Malicious Google Drive Links
Unfortunately, we can’t analyze your malware from out here. Sounds like that link may be pretty sketchy, but we can’t say one way or the other. If you’re super curious to know more, one pretty common ...
- 941
1
vote
SPF and DKIM passes for SPAM message when using SES and Google Mail
From the header you posted, "WEBSITE-DOMAIN.org" is your domain, correct? If so, then this spammer is spoofing the header from address. You can prevent header from spoofing with DMARC.
DMARC confirms ...
- 145
1
vote
Accepted
Would it be HIPAA compliant to share docs with EHR data between two HIPAA compliant Gsuite organizations
If as you say, both entities have entered into a business associate agreement with Google they are able to use G Suite for PHI sharing. Google supports HIPAA compliance for G Suite). Provided the ...
- 56
1
vote
What is the point of restricting a google API key by HTTP referer?
If you're allowing anyone to use your client API key, fundamentally there's no way to prevent misuse. This just makes it annoying enough that it might deter some people. Doesn't hurt to enable it, but ...
- 111
1
vote
Why can't Google Forms be used for elections?
When we want to digitalize something, we should try to modelize what is required, then what are the interactions, and only then examine the possible solutions.
Speaking of elections, the common ...
- 26.9k
Only top scored, non community-wiki answers of a minimum length are eligible