It is not a problem if you’re not handling sensitive data. I’m not against Google Drive link sharing.

None of the above (and the many other ways that a shared link can be discovered) require the brute-force discovery of your document’s URL address.

The document is discovered through URL referrals.

A negligent employee accidentally tweets the link, emails it to unintended recipients, or backlinks to it in another public document.

Former employees who have the document’s link will still be able to access it after they leave your organization.

Here are a few examples of how a shared file can be exposed to unwanted users: Google Drive link sharing is a prime example of “ security by obscurity,” which means your data is safe only because other people don’t know about it, not because they don’t have access to it. But there are still many other ways link-sharing can turn into a security and privacy disaster. Google Drive’s new security update makes brute-force link discovery has become harder. Google Drive link sharing is still a privacy disaster People who are accessing it for the first time will need to make an access request, which requires the approval of the file owner.īasically, this means that if you had applied link-sharing to some old files in your Google Drive and forgot about them, the security update will prevent malicious actors from guessing their URLs and accessing them without you noticing it.

It will add an extra parameter to the shared document URL called “resourcekey.” People who had previously accessed the file will still be able to access it with the old link (without the resourcekey parameter). Google Drive’s new security update applies to these files. However, if you have shared files from around early 2017, their URLs are still in the old format.

Note that if the same file is shared through the “restricted sharing” feature, then the attacker will only know of its existence but won’t be able to access its contents.Ī few years ago, Google updated its address-generation scheme to make it more difficult to guess document URLs. In such cases, if an attacker discovers the URL of a Google Drive file that happens to be made public through link-sharing, they will be able to access its contents. But several experiments have shown that, in fact, many popular cloud storage services were previously vulnerable to URL-guessing attacks. So, a malicious actor should not be able to stumble on a document by randomly generating a Google Docs address. Google and other cloud storage services (Microsoft, Dropbox, etc.) generate unique URLs for each document you create.

Is google drive secure for file sharing