Hacker News Reader

Comment by hatch_q | Hacker News Reader

But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?

i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search

So I'm not the only one.

It's even worse than that though, enter 'myintranetsite' and hit return, and you end up on a Google search page. Instead you have to enter 'http://myintranetsite'

Type myintranetsite/ instead, this is faster than http:// in front.

Wow, a usefull shortcut I was not aware of. Thanks.

As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/".

If you prefix with "http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:")

> If you prefix with "http://", no requests are made to Google (except "h", "ht", "htt", "http", and "http:")

This seems surprising to me. Can you back up this claim?

If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason.

- https://support.mozilla.org/en-US/kb/search-suggestions-fire...

No I get that part.

I guess I just had a different interpretation of "no requests are made to Google". It seems "no requests" was intended to be "no search suggestion requests" and not "no requests that leak this information to google".

> If you have search suggestions enabled then "http:" will be sent

What's the point of sending those characters?

Search Suggestions. You typed "h", maybe you want to search for "harpoons". "ht" might suggest "htaccess". "http" might be a search for "httpie". etc.

Yes, of course :-P

Doesn’t browser hit suggestions API on every type stroke anyway?

This is easy to turn off, in Firefox, at least.

I often have the opposite problem: I'm on Firefox and try to google "FooError: Bar happened" and instead of directing to google, Firefox prompts me to select an application to open "fooerror links".

You can enable the search bar, Ctrl-k focuses on it.

- https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...

On Firefox you can disable this via an about:config setting (set keyword.enabled to false).

ahh cool.. but a binary toggle is a bit to coarse.

it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.

Or just have two text inputs[1]: one for url and one for search, rather than trying to overload two functions into one text input and trying to guess what the user wants.

[1] https://support.mozilla.org/en-US/kb/add-search-bar-firefox-...

oooo didn't know that setting was available!

In your search settings you can add keywords. So if you set ? as the keyword for google you can type '? foobar' into the address bar to google for foobar.

(firstly you should set a different default search engine)

It's been nice to use the Firefox setting to have a separate search bar. Your address bar will show more results from your history, which is often what I actually need. Then you can just hit the down arrow to select "Search with x" options.

My only minor quip is that your default search engine will be last in the list.

So the latest Firefox broke that for me. It seems to front-run my URLs as I type them and if the result is a 404 it sends me over to DDG with my URL as the search. :/ Really, really obnoxious but I haven't taken the time yet to paw through about:config to see if I can turn it off.

I work at a place that takes this all very seriously. No. Google search is available but monitored, skype/gitlab/bitbucket/etc are all blocked. Code formatting tools are blocked to the extent possible and people are instructed not to use them. Folks that slip up and get caught are usually written up the first time, after that they are terminated.

The only way to legitimately use tools like these from work are if they pass rigorous vendor assessment processes and rock solid contracts in place covered by nine figure E&O policies.

Do you work in a field that warrants this kind of stringent requirements or is the security team overzealous? Do these kind of rules extend to using third party libraries etc?

Both probably. Most of these rules have come as a result of regulatory action/audit findings. Efforts to dial these back repeatedly get stymied by people demonstrating the need for such checks.

Re: third party libraries, yes absolutely.

Well, if you're using slack for example you'll normally find that business use it to send a lot more senstive stuff to each other than just API keys. If your slack gets breached you've pretty much got yourself a data breach that you'll need to report (if you're covered by GDPR. If you're GitHub is breached you've probably got major issues and need to do a code aduit to make sure there are no backdoors. If any part of your infrastructure is comprised, you're in trouble. If you get to the nity gritty you've got to store senstive data somewhere.

Honestly, I find it super annoying when someone is fine with me sending them a link to kibana to which the access details are in slack to see a API key but have an issue with me sending the API key to them via slack. The whole we don't trust slack but we'll send customer data to each other via it, have all of our secret business info on it, but the API key for an internal service that just outputs public info, that's too dangerous.

Oh, and then there are the people who store everything on vault or something and then give out the password willy nilly. Mate, if it's got to be encrypted then we shouldn't be giving it out to everytone. If it's got to be given out to everyone then it's not senstive data, it's just private.

For most businesses, the main thing you need to keep safe is your database.

It is not.

In a project I'm working on we encrypt our secrets with git secret before sending them to GitHub.

When we want to quickly share unencrypted secrets between us we drop them as files into a server we access over ssh. That should be OK.

The gist of it is that if a secret is in clear on a server outside our organization it's not secret anymore. And yet my customer trust their cloud provider (Google) with their data.

No, it definitely isn't. Github (and probably others) will show you big scary warning messages if you commit things like AWS keys.

What about when you commit a file with client data or PII?

How does that work on the command line? Does it reject your push? Or is this only for people editing on the github website?

But atleast you have an SLA with most of these services if you are using them on an enterprise level. You don't have any such SLA with Auth0 when using jwt.io.

edit: typo

Depends on who's paying for it. For "free" services like Google Translate I wouldn't put anything work related through it.

Reply on news.ycombinator.com