Hacker News Reader

I think it might be relevant, this seems to indicate that google is hardcoding their API keys in the shipped chrome binaries. These exceeded, and broke functionality in the app. This seems like a bad security practice and it is very relevant to call it out here.

View on HN

There's really no practical alternative but to ship binaries with baked in API keys.

Maybe you dynamically provision API keys, but the binary needs a baked in permission to access that API to start with...

so every release goes out with its own API key?

Well, they're obviously going to have to hardcode something into the binary, I think you're imagining an issue that doesn't exist.

Reply on news.ycombinator.com