313 votes
Accepted

How does Google know where I am?

Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location ...
INV3NT3D's user avatar
  • 3,997
58 votes

How does Google know where I am?

You disabled WiFi and GPS, but you still have cellular data turned on. That means that the phone is in communication with the local cell towers. Android uses cell tower geolocation to estimate your ...
John Deters's user avatar
  • 34.2k
38 votes

Can IT see my Google Drive traffic?

The answer is no and yes too. Why no: It's a HTTPS traffic and firewalls these days have application identification or deep packet inspection (whatever you call it). That will identify the ...
user140452's user avatar
24 votes
Accepted

What is the point of restricting a google API key by HTTP referer?

All security measures are trade offs. Is the cost of the control worth more or less than the value of what is being protected, and how much more work does it force the attacker to do. A lock on your ...
JesseM's user avatar
  • 1,942
7 votes

What is the point of restricting a google API key by HTTP referer?

The "referer" is set by the browser to contain the address of the calling site, so if you restrict access to the google api by only allowing your web site address, you are preventing other people from ...
xtian's user avatar
  • 171
6 votes

Why would distributing via Google Play be more secure than distributing APKs?

One of the best security practices is keeping your software up to date. With the Google Play Store, you can set your installed apps to update automatically (if this isn't already set by default). To ...
Terrance Tambling-Goggin Orz's user avatar
5 votes
Accepted

Why would distributing via Google Play be more secure than distributing APKs?

First and foremost, publishing an APK on your website encourages bad security practices on the user's part. In my opinion you should be encouraging the average user to trust only the Google Play ...
Cody P's user avatar
  • 1,148
5 votes

How does Google know where I am?

According to Google: How Maps finds your current location Maps estimates where you are from sources like: Your web browser’s location information. Your phone's location, if you have ...
FatSecurity's user avatar
5 votes

What is the point of restricting a google API key by HTTP referer?

What is the point of restricting a google API key by HTTP referer? A web application cannot easily forge its referrer when issuing requests. Therefore, restricting allowed referrers to a specific ...
Arminius's user avatar
  • 44.8k
4 votes

Why would distributing via Google Play be more secure than distributing APKs?

When you use Google Play to distribute your app, you declare that you comply with Google's Content Policy, which means that the app is safer for the end users in many ways, including some security ...
Alex Cohn's user avatar
  • 848
4 votes

Can IT see my Google Drive traffic?

If your traffic is HTTPS, the content of packets will not be visible. They would see generic traffic out to google docs, but no definite data will be readable from the traffic. They will know you ...
Heigou's user avatar
  • 49
4 votes

Are all Google app-passwords equal? What is their attack scope?

Google hasn't publicly disclosed the scope of app passwords, but there are a few things we can reasonably deduce about them. One way is to review Google's help information about them. Note especially ...
Royce Williams's user avatar
4 votes

sealed data from a stolen laptop

... who doesn't have time for a drive encryption project Given that most modern systems support drive encryption out of the box or this can easily added, this arguments sounds weak to me. Apart from ...
Steffen Ullrich's user avatar
3 votes

Distribute Program with Sheets API Credentials

I am a Google GDE Cloud Platform, security is my specialty. The credentials.json file that you mention contains the Client ID and Client Secret. With this credential file, an attacker can create ...
John Hanley's user avatar
3 votes

Shouldn't user content return 403 forbidden?

This is called capabilities-based security and it's a good option when you have highly distributed shared content. All users that require access are given a unique URL which is equivalent to a token. ...
GnP's user avatar
  • 2,299
3 votes
Accepted

Can I trust Google Scripts on sites like Labnol?

I am the author of Gmail script that you referenced in the question. The script is now available as a Google-approved add-on on the Chrome Store. It requires access to the entire Gmail because, ...
Amit Agarwal's user avatar
3 votes

Why can't Google Forms be used for elections?

In general, we can't use a third-party vendor's website for public systems, since anything can happen beyond our control. If we host a site similar to Google Forms and it was managed by us, we may ...
BlueBerry - Vignesh4303's user avatar
2 votes
Accepted

Can Google Docs be used to “sanitize” a Word or Excel document?

The strategy you propose might indeed break malicious code, but with 0 day exploits there is no way to be sure. If it is just the flat text that you want, the safest way to go might be to open the ...
user7091295's user avatar
2 votes

Distribute Program with Sheets API Credentials

As other's have mentioned, the credentials.json file gives access to your account. It's not something you want to share with people. However there are two points worth clarifying: Publishing it ...
Conor Mancone's user avatar
2 votes

Can a google form contain a virus or other malware?

A Google form is a page hosted by Google to collect information from sources in text boxes, radio buttons etc. We cannot say that it is 100% secure but it is highly unlikely that you will get infected ...
whoami's user avatar
  • 1,366
2 votes

Can Google Policy Profile remotely erase all data on the device?

The short answer is "Yes". If the phone given to you is a "company phone", you must comply. If this is your phone, as the message mentioned, you must contact your company IT to check out the ...
mootmoot's user avatar
  • 2,397
2 votes
Accepted

Would it be a big security vulnerability if someone wrote a browser extension to retrieve personal information on Google's behalf?

It would be a security vulnerability, yes. Executing javascript code in the context of a web page allows that code more or less full access to the content of the page, in this case Google Drive. Such ...
vidarlo's user avatar
  • 16.1k
1 vote

Are spam invites on Google calendar dangerous?

it is not dangerous unless you open a link, or open any kind of attachments. of course vulnerability in Google calendar is another issue. (like zero-day exploits that are out of your hands). in ...
H. Far's user avatar
  • 29
1 vote

Google Drive and GDPR

This is article 6, lawfulness of processing: Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent to the ...
reed's user avatar
  • 15.8k
1 vote

What are the risks of visiting someone else's Google Photo while logged in?

Google will log your IP address and device type, then set or check some cookies to identify your device and see if you are signed in with a Google Account. If you are concerned about being tracked by ...
user188415's user avatar
1 vote

Malicious Google Drive Links

Unfortunately, we can’t analyze your malware from out here. Sounds like that link may be pretty sketchy, but we can’t say one way or the other. If you’re super curious to know more, one pretty common ...
securityOrange's user avatar
1 vote

SPF and DKIM passes for SPAM message when using SES and Google Mail

From the header you posted, "WEBSITE-DOMAIN.org" is your domain, correct? If so, then this spammer is spoofing the header from address. You can prevent header from spoofing with DMARC. DMARC confirms ...
Sequoyah's user avatar
  • 145
1 vote
Accepted

Would it be HIPAA compliant to share docs with EHR data between two HIPAA compliant Gsuite organizations

If as you say, both entities have entered into a business associate agreement with Google they are able to use G Suite for PHI sharing. Google supports HIPAA compliance for G Suite). Provided the ...
NetSecSteve's user avatar
1 vote

What is the point of restricting a google API key by HTTP referer?

If you're allowing anyone to use your client API key, fundamentally there's no way to prevent misuse. This just makes it annoying enough that it might deter some people. Doesn't hurt to enable it, but ...
sudo's user avatar
  • 111
1 vote
Accepted

Infecting synchronized devices through the cloud

As for Dropbox vs. Google Drive, I don't know which one is more secure. I think it's a matter of personal preference. If you have malware, files on your cloud drive can get infected by viruses, or ...
jornane's user avatar
  • 425

Only top scored, non community-wiki answers of a minimum length are eligible