“An update of security will be applied to Drive,” says a new email from Google. In addition to this message, visitors to drive.google.com will also be able to read one saying: “On September 13, 2021, a security update will be applied to some of your users. files.” And below is a list of affected files that received an unspecified “security update”. So what is it about?
Google is changing the way content sharing works in Drive. Drive files have two sharing options: a single-person whitelist (through which you share a Google Doc with specific Google accounts) and a “get link” option (when anyone with the link can access the file).
The “get link” option works the same as videos not listed on UAF YouTube. The links are not really private but theoretically not exactly public as they must be posted somewhere. But secret sharing links are actually “security by obscurity” as it is possible to guess the address.
In addition to Google Drive, update hits YouTube
Along with Drive, Google is also changing the way YouTube's unlisted links work. A message on the YouTube support page describes this change: “In 2017, we released a system update that generates new unlisted YouTube links that include security improvements that make the links to your unlisted videos even harder to discover by someone if you haven't shared the link with them”.
Google knew about the problem of secret guessed links, and in 2017 it changed the way link generation works. According to the Ars Technica website, this does not affect shared links prior to that.
- Scammers use Windows 11 to spread malware; see how to prevent
- How to prevent card data from being filmed on deliveries
- Vulnerability leaves admin passwords exposed on Windows 10 and 11
Soon, Google will require that your old links be changed, which could break them. Google's new linking scheme adds a “feature key” to the end of all Drive shared links, making them harder to guess.
So a link that looked like “https://drive.google.com/file/d/0BxI1YpjkbX0OZ0prTHYyQ1U2djQ/” will now look like “https://drive.google.com/file/d/0BxI1YpjkbX0OZ0prTHYyQ1U2djQ/view? Resourcekey = 0-OsOHHiQFk1QEw6vIyh8v_w”. According to the company, the feature key makes it harder to guess.
Update page lists affected files
If you go to drive.google.com/drive/update-drives, you will see a list of the affected files, and if you hover over them, you will see a button on the right to remove or apply the security update.
“Applied” means the feature key will be needed after September 13th and will (mostly) break the old link, while “removed” means the feature key is not needed and all existing links should continue to work.
YouTube already went through this process earlier in the month, with all links not listed before 2017 disappearing. However, Drive is doing this with a little more subtlety than the video platform.
Thanks to account-based sharing, anyone who has accessed your unlisted Drive links in the past will still have access to them, even if you update security. However, no new users will be able to access the old updated link.
That way, if you have a stable community that uses an unlisted file, it should be able to continue browsing. All new members, however, will be blocked and will need to request access. If you don't want this, at any time the owner of the file can click on the “share” button and change the settings to generate a new link or turn off the link altogether.
To ensure real security, caution must be exercised.
Not allowing third parties to create a list of all your unlisted files is a good thing, but we can't confuse this link change with any real security.
You should never share anything about “unlisted” or “get link” resources on YouTube, Drive or Google Photos if you really want it private.
Secret links are just security through obscurity and, even with updates from Google, they should not be considered secure or undetectable. This arrangement is entirely suitable for casual documents, but always assume that anyone in the world can read an “unlisted” file.
If that doesn't bother you, great. But if you don't feel comfortable, use the sharing actually based on private Google accounts.
Have you watched our new videos on UAF YouTube? Subscribe to our channel!