Hacker News Reader

"You can attach photos from Drive to posts in Google+"

And this reminded me how much stuff I already have sitting in Google. A minor glitch last week meant I couldn't access my webmail (though I primarily use IMAP), which made me start thinking about this.

I'm really pleased to see Drive come out but at the moment I feel reluctant to put too much stuff into it because I become even more dependent on the big G (and I'm actually surprised I feel this way and it's only a recent thing). Perhaps this feeling will fade but I'm not sure.

Having an OS on my machine is great since the maker (MS/Apple) can't simply turn it off. Having Google become my "cloud OS" makes me nervous.

Well it's a good thing a major point of the product is the local copy :)

Yes, but that's not really what concerns me. It's that my workflow runs through those services.

To clarify, email (basically your identity online), calendars, device syncing, now file-sharing can be run through Google (and I'm sure a whole lot of other things too). If these were to disappear* I'd basically be left with a nice shiny box, where I could 'work' but in a much more limited way. It would feel like being on a digital desert island (e.g. I do this now by working in places that don't have wireless and letting things 'sync' when I'm back online).

I guess I'm just wondering how few companies are in a position to offer services like these, resulting in Google getting all my stuff. It's not bad per se but it is making me wonder what my options really are.

(edits for clarity)

*I'm referring to the odd story of people getting locked out of google accounts. I know it's rare.

People get hacked and/or locked out of accounts surprisingly often. A good (and tech-savvy friend) was recently hacked, and managed to get thousands of dollars transferred before found it.

PLEASE, PLEASE, PLEASE, if you have a Gmail account please follow Jeff Atwood's directions below. Turn on two-factor authentication, make sure you've verified a phone number and recovery email address account.

http://www.codinghorror.com/blog/2012/04/make-your-email-hac...

It eliminates virtually all of the easiest "threat vectors" to your Gmail account.

Suppose you turn on two factor authentication, and then something happens to the phone number you used for it. Does that mean you've effectively lost your Gmail account? (Not a rhetorical question. I don't know how or whether you can lose a cell phone number - as opposed to just the physical phone, which presumably shouldn't be a problem - but that doesn't necessarily mean it can't happen.)

The two-factor auth system does not use the phone as a phone, just as a hardware token. Google displays a token on the login screen, you enter this in your phone and type the code it gives you in to the login page (similar to RSA's SecurID, but your phone is the device).

You seem to be referring to some othet Google auth system. The two-factor system used for Google accounts sends a code via SMS that you need to enter on the web page. It does not make you enter something on your phone.

Ah, I see. Yes, looks like Google offers multiple phone-based two-factor systems. I was referring to the oAuth one, which uses time-based tokens rather than sending the code via SMS.

I see. But does that qualify as a two-factor auth? You need two independent "factors" for that, and while OAuth uses tokens internally, all it does is ensure a secure transport between Google's servers and the app that requests authorization. It doesn't actually obtain two different things from the user.

No, that's not exactly what he means. The "token" isn't the OAuth native token, it's a 6-digit code that is based on the current time and a device secret embedded in the app on your phone.

What you are referring to isn't part of the OAuth spec, as far as I know, is it something particular to Google's API?

The cached access token could also be considered a factor, although it depends on the token expiry policy. If the token doesn't require a refresh using a refresh token (which must prompt a password) often enough its security is compromised.

I don't know what kind of expiry Google's OAuth token has, but last time I tested this, it was a very long time. I believe Twitter's live forever. Facebook's offline access scope (which you will need for a normal app) lives forever until the user changes his/her password (see http://developers.facebook.com/blog/post/2011/05/13/how-to--...).

Oh, I see, it's actually an app you install on your phone.

There is an google authenticator app for android that you can register with your two factor auth so you can just open the app rather than wait for the text message.

It's not just Android. It's Android, iOS, and BlackBerry.

http://support.google.com/accounts/bin/answer.py?hl=en&a...

In regular use, you enter a code from an app, rather than using any network features of the phone. You can also set up (either as default or as backup) a phone number to text with a code -- as backup, they recommend sending to someone else's phone.

Lastly, they will give you a list of ten one-time-use codes which you can write down or print out and put in your wallet/safe.

If all the above fail, I believe there's an account recovery procedure, which takes a couple of days and involves sending proof of ID.

So you're not relying on a single device, and certainly not on a single phone number, to be able to retain your account.

In my experience two factor auth sends a a text message to the provided phone number with a code which you then enter on screen so retaining control of the number is a requirement.

You can set up an alternative number, and can also print out a bunch of one-time use codes. One of these methods should be enough to log in and change the settings.

> digital desert island

Welcome to the Navy-Marine Corps Internet!

Even if it feels better to be in control, Google is still better than most individuals at not losing data.

Is there even evidence of Google really verifiably loosing any user data? If not, considering the amount of data they handle, they can probably be considered the best at not loosing data, from a bayesian point of view.

There's a business opportunity out there for someone to build a "Google Backup" tool. It would synch your G-drive to Dropbox, your Gmail to yahoo mail, and so on. Marketed as "in case they turn evil" and intended people like you (and me!) who have this concern.

The company would become useless if Google ever fixed their customer service problems ("they closed my account and wouldn't say why!"), but Google has demonstrated they WON'T fix that.

It's not strictly an apples/apples comparison, but there are several apps like Spanning Backup(1) on the GApps Marketplace that offer whole-account backup.

1. https://www.google.com/enterprise/marketplace/viewListing?pr...

The amount of time I have been unable to access something because of a Google outage is much much lower than the amount of time I have been unable to access something because I lost my flash drive, left my laptop at home, etc.

well, have you thought about how much "self serve IT" works for average consumers before cloud based services? for ex. can you aunt download and configure a mail client, or does she just have an @yahoo

Some more thoughts on where this could go in the future:

This whole thing is great for Chrome OS and Chromebooks. Right now, using a Chromebook is an experience that comes with a lot of sacrifice. You can't really do much with a lot of the files that you're used to using on Windows. You're locked to a browser UI that limits your flexibility.

But with the upcoming new Aura UI and Google Drive, suddenly you've now got an experience very similar to Windows. You have a desktop that you can put apps on, and you can open arbitrary files using any app that supports it and is available in the store. Now the distance between Windows and Chrome OS is suddenly very small relative to how large it was last year.

This makes me very excited to find out what Google plans to talk about at Google I/O. I wouldn't be surprised if they introduced a new Chromebook model built around the coming together of the new UI and Drive.

Web intents!

http://blog.chromium.org/2011/08/connecting-web-apps-with-we...

> Basically, you register your app against certain mime types, and then when users install your app into Chrome, they can now open those file types directly from Drive using your app, seamlessly.

It took a minute for it to hit me how brilliant that is. I'm really interested if webgl developers will do anything interesting with this.

It's kind of disingenuous for them to call it an "open platform" when the only way to get API access is to distribute your app through the Chrome Web Store. What if I want to build something that works on multiple browsers? Am I just out of luck?

You actually can get access to these apps in other browsers through the Chrome Web Store. Try adding any of the Drive enabled apps. The experience is a little odd right now, but it works.

I get a big scary message telling me that most apps won't work without Chrome.

But the important thing is that there's no reason they can't. Google's release partners understandably target the browser that is used by Google fans, since they will be the early adopters.

So long as this is a temporary situation, which I think it is, I wouldn't be worried.

For anyone wondering when this will come out for Apps:

  A Google Apps version of Google Drive will arrive for 
  Google Apps admins on the rapid-release track "over the 
  next few weeks," Google said; it'll also include 5GB free 
  but monthly prices beyond that will be somewhat more 
  expensive, for example $4 a month for 20GB or $89 per 
  month for 1TB.)

  http://news.cnet.com/8301-1023_3-57419024-93/google-drive-its-slick-integrated...and-not-exactly-free/

When GDrive for Apps launches, it will enable a new sort of workflow, where a user can open specified file types in GDrive with internal webapps behind a VPN. If combined with the existing Google Docs API, this could be the start of a whole new class of business process apps. Interesting.

"Starting today, Google Apps administrators will see new controls for Drive in the control panel," a Google spokeswoman said. "Users at organizations on the Rapid Release track will be able to opt-in to Drive at drive.google.com/start."

http://www.pcmag.com/article2/0,2817,2403464,00.asp

BUT will the experience be seamless and actually replicate a proper file system, OR the current experience of having files on the web (Box, DropBox, SkyDrive) and not being able to attach/read/edit files. Currently you need native integration with these online services in iOS. When will they actually be web based file systems, universally accessible via API?

I am sorry, but skydrive has basically ms office build in. you can easily create/edit files. although it is obviously not the complete office suite, it is definitely very decent.

Sure, and I love that SkyDrive is built into office... but accessing those files on the go, or with any other programme is a nightmare. What do I do with my other files? Spread them across different services?

IF Office comes to iOS, THAT will be a game-changer. And I don't mean the lame Windows Phone 7 implementation. I would EVEN be happy with Office from Windows 3.1!

Image Google Data Liberation is as simple as copy a folder out of Google Drive.

Does any of the cloud competitors already offer a similar api that would let my app users use their infra instead of mine? Or associate my app into their ui? Or is this a novel from google?

Windows 8 and Skydrive has a similar concept built into it called contracts. Developers can integrate their app to work with Windows 8's UI. For example you can search your Flikr or Facebook directly in the OS in the same way that you search the file system.

Here's a video demonstration: http://www.youtube.com/watch?v=Hesj1I_wsqI#t=12m00s

http://blogs.msdn.com/b/windowsappdev/archive/2012/03/23/act...

Win8 contracts seem very similar to Android's "Intent" functionality.

We currently do that with http://filepicker.io/ across multiple cloud providers (only Dropbox and Facebook for now though)

We currently only support opening and saving back files but we plan to add save-as support in the next few days

I remember some Googlers talking about web intents last year which sounds a bit similar concept, but I guess this is something separate form that one.

They were writing about it in context of Chrome: http://blog.chromium.org/2011/08/connecting-web-apps-with-we...

I'm really looking forward to see this because the few apps that used Dropbox for this where brilliant, for example CineXplayer on iOS to store videos.

Interesting. I didn't see any reference to them in a quick scan, but it would be great if this worked with Web Intents as well.

'...send faxes' - how quaint!

Hahah yeah, that grabbed my attention too. Last month I registered a company as an iOS developer, and there was a lot of faxing to Apple involved. It took me a while to find a working machine in the building, and figure out how to send these things...

Drive competes with lots of SAAS companies!!

> I think it's a brilliant move that shows Google thinking ahead

to me this looks just as a reaction to Apple's cloud offering, which already integrates all data for apps running in iOS.