{"action":"created","issue":{"url":"https://api.github.com/repos/ncw/rclone/issues/309","labels_url":"https://api.github.com/repos/ncw/rclone/issues/309/labels{/name}","comments_url":"https://api.github.com/repos/ncw/rclone/issues/309/comments","events_url":"https://api.github.com/repos/ncw/rclone/issues/309/events","html_url":"https://github.com/ncw/rclone/issues/309","id":128056703,"number":309,"title":"Google drive security?","user":{"login":"Chris2048","id":347288,"avatar_url":"https://avatars.githubusercontent.com/u/347288?v=3","gravatar_id":"","url":"https://api.github.com/users/Chris2048","html_url":"https://github.com/Chris2048","followers_url":"https://api.github.com/users/Chris2048/followers","following_url":"https://api.github.com/users/Chris2048/following{/other_user}","gists_url":"https://api.github.com/users/Chris2048/gists{/gist_id}","starred_url":"https://api.github.com/users/Chris2048/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chris2048/subscriptions","organizations_url":"https://api.github.com/users/Chris2048/orgs","repos_url":"https://api.github.com/users/Chris2048/repos","events_url":"https://api.github.com/users/Chris2048/events{/privacy}","received_events_url":"https://api.github.com/users/Chris2048/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-01-22T00:50:38Z","updated_at":"2016-01-23T21:02:38Z","closed_at":null,"body":"This is in the drive code:\r\n\r\nrcloneClientSecret = \"8p/yms3OlNXE9OTDl/HLypf9gdiJ5cT3\"\r\n\r\nIs this not a security concern?"},"comment":{"url":"https://api.github.com/repos/ncw/rclone/issues/comments/174222287","html_url":"https://github.com/ncw/rclone/issues/309#issuecomment-174222287","issue_url":"https://api.github.com/repos/ncw/rclone/issues/309","id":174222287,"user":{"login":"Chris2048","id":347288,"avatar_url":"https://avatars.githubusercontent.com/u/347288?v=3","gravatar_id":"","url":"https://api.github.com/users/Chris2048","html_url":"https://github.com/Chris2048","followers_url":"https://api.github.com/users/Chris2048/followers","following_url":"https://api.github.com/users/Chris2048/following{/other_user}","gists_url":"https://api.github.com/users/Chris2048/gists{/gist_id}","starred_url":"https://api.github.com/users/Chris2048/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chris2048/subscriptions","organizations_url":"https://api.github.com/users/Chris2048/orgs","repos_url":"https://api.github.com/users/Chris2048/repos","events_url":"https://api.github.com/users/Chris2048/events{/privacy}","received_events_url":"https://api.github.com/users/Chris2048/received_events","type":"User","site_admin":false},"created_at":"2016-01-23T21:02:38Z","updated_at":"2016-01-23T21:02:38Z","body":"Hmm, sounds like a common problem then.\r\n\r\n@ncw:\r\nI think you might be right about the answer being wrong.\r\nAs I understand it, the role the sk plays that an app con pretend to be rClone, and get a token using the google auth UI. But any app could just as well pretend to be rclone, with their own appid and secret anyway. There would be no token granted without a new user access approval (that right?), and afaik if the token was already obtained somehow, it can be used without the sk (is that right?).\r\n\r\nI think the more pertinent info is:\r\n> Furthermore, the client secret leak breaks a layer of protection designed to ensure the legitimacy of the communicating server.\r\nWhich seems to be the case, and also, something in a flaw for use cases involving oath and client-side code :-/\r\n\r\n\r\nIncidentally, I don't think binaries or 'Encrypted' secret ids are that great.\r\nI took the SE commentors advice, and setup my own app & key. When I inserted it into the rClone code, I got an error about it not bein a valid base64 code, or something - it wasn't hard to figure it out; namely find:\r\n\r\n> fs.Reveal(rcloneClientSecret),\r\n\r\n>func Reveal(y string) string {\r\n>\tx, err := base64.StdEncoding.DecodeString(y)\r\n>\tif err != nil {\r\n>\t\tlog.Fatalf(\"Failed to reveal %q: %v\", y, err)\r\n>\t}\r\n\r\nin the code, and base64 encode it. Incidentally, I think it would give the wrong idea to call this 'encrypted', when it's really just obfuscated. If *I* can do it, anyone capable of exploiting an Oauth SK could easily do it too.\r\n\r\nAs for binaries - If the app eventually sends the SK, it has to decode it, at which point a debugger trace / memory dump can reveal it. A bit harder, but not a vast challenge.\r\n\r\nI think ultimately, any client-side code holding a SK needs either a per-client key, and if the protocol doesn't handle this case, obfuscation is maybe the best that can be done?\r\n\r\n> You can already provide your client details in the setup process.\r\n\r\nI hadn't realised this actually - v. useful.\r\n\r\nHere is a suggestion that would impact user ease a bit, but maybe the obfuscated app/sk could be put on the github page, and any user wanting to use them *have* to enter them.\r\n\r\nThe advantage would be they would naturally wonder why they have to do this, and the gh page can explain the situation in full, hence informing them of the issues. This, rather than \"just working\" out of the box, but with default credentials.\r\nJust an idea :-)\r\n\r\n\r\n\r\n"}}