Decide how to apply link-sharing security update to Drive - what does this affect?

[dan_davenport]

https://support.google.com/a/answer/10685032

I'm curious about this pending security change. Will it affect all public facing documents? I.e, if we have documents in a folder on a website, will we have to change how we share those? Or am I misunderstanding what this update does?

[dbaker3 · Accepted solution]

From reading the Dev. documentation it would appear that this only impacts historical documents created before a certain point (though this can not yet be confirmed). I imagine from the timing of everything, and from inception to completion in less than 90 days that there was most likely a security vulnerability with how document IDs are generated and possibly a way for someone find documents with "shared with anyone with link", and many of these documents could contain personal or confidential information, but shared with an individual without a Google Account.  The 90 days would indicate that this was caught in Google zero day or possibly another disclosure (just my opinion).  Now what this means moving forward is anyone's guess because support and documentation appears to be very incomplete, and you can not even report out what files/folder, etc. are impacted. Our small school is showing over 75,000 impacted files and 13,000k impacted folders, but no way to determine what those files/folders are. 

I must admit it would be nice to see the sharing piece overhauled a bit, IMO shared links should not contain the actual document ID, and should be re-settable and revocable from the document share function and or directly from the admin interface.

[vamsi_krishna_p · Accepted solution]

Hey Amira,

It is for the files posted publicly with "Anyone with the link".

Thanks

[nicholai · Accepted solution]

This brings up a great question.  Will any shortcuts stop working after the update and is there a way to fix the shortcuts off the will stop working?  

[dominik]

This is a thing I actually want to write a post about. It seems to me an edu focused feature (judging by the default on for EDU). Will look to get some more insights from a Googler or two.

[dbaker3 · Accepted solution]

From reading the Dev. documentation it would appear that this only impacts historical documents created before a certain point (though this can not yet be confirmed). I imagine from the timing of everything, and from inception to completion in less than 90 days that there was most likely a security vulnerability with how document IDs are generated and possibly a way for someone find documents with "shared with anyone with link", and many of these documents could contain personal or confidential information, but shared with an individual without a Google Account.  The 90 days would indicate that this was caught in Google zero day or possibly another disclosure (just my opinion).  Now what this means moving forward is anyone's guess because support and documentation appears to be very incomplete, and you can not even report out what files/folder, etc. are impacted. Our small school is showing over 75,000 impacted files and 13,000k impacted folders, but no way to determine what those files/folders are. 

I must admit it would be nice to see the sharing piece overhauled a bit, IMO shared links should not contain the actual document ID, and should be re-settable and revocable from the document share function and or directly from the admin interface.

[JohnP]

Totally agree - shared links should definitely not contain the Id and need to be resettable and revocable! We have around 250 kids PK-12 and we only have 125 files and 2 folders though - we're a super small school!

[amira]

Can anyone clarify if the impacted files are files in the domain that are published publicly and/or have "anyone with the link" enabled?

[vamsi_krishna_p · Accepted solution]

Hey Amira,

It is for the files posted publicly with "Anyone with the link".

Thanks

[brian_kim]

@dominik i think this may be a good idea for a recorded session too for workspaceadmins.org 😉 

[robyn_bredvick]

We are also very curious about this change. We started a Google Support chat to confirm when the new URLs can be created and will there be a short time when both URL's work. We have used the sharing link feature for sharing things on our websites and heavily at our library, so we have hundreds if not thousands of links out there. The support specialist said that the URLs will not change until the Sept 13th date. But if that is correct, that means all of our links will break on the same day, with no chance to fix them during a grace period. Has anybody else had this confirmed this? We obviously want to enable this feature, but we also don't want to have all of our publicly shared links broken at once. 

[nicholai · Accepted solution]

This brings up a great question.  Will any shortcuts stop working after the update and is there a way to fix the shortcuts off the will stop working?  

[robyn_bredvick]

We did end up asking the support agent if they could confirm their statement that we would not be able to recreate the links until the September 13th switch. We did end up hearing back and wanted to pass along the good news:  

 users will be able to generate the new links starting on July 26th, 2021. This as long as the new sharing setting from the Admin console is set to "Apply security update to all impacted files".

[johan_olsson]

From my conversation with Google support I interpreted it as:

• Users with access through "Anyone with the link can" would only be able to access it with the new link or by share request.
• Users with direct access (shared directly to account or group) would still be able to access the file using both the old URL, and the new URL.

Could anyone confirm that I've understood that correctly? For our organisation it would be a small catastrophy if that was not the case and the old link would not work for users shared with "direct access" once the new link is generated. 

[js14]

A follow-up question: the message in Alert Center helpfully tells us how many files are shared, but is there any way to get a list of the files and their owners? Not really looking forward to dealing with 17k+ files during the summer when staff may not actually be around to fix their own links...

[vamsi_krishna_p]

Admins can use the Alert Center to see how many users, folders, shared drives, and files are affected in your organization. Look for an alert with the subject “Security update for Drive.” There is no information provided on how admin can view the affected users and files

[tbigby]

We have 360,000 items to manage... A lot are linked on public websites too.

I don't think this has been communicated well at all, I'm sure I'm not the only one with questions.

Some questions:

• If we choose to 'Remove the security update', will newly published files after September have the new link security anyway?
• If we choose to 'Remove the security update', can a user apply it manually to a file?
• Who would have permission to 'remove the security update' on a file (if the option 'Apply but users can remove it) - is it only the Owner, or can Editors do this?
• The document says "There’s no option to remove the security update from folders" - we have 23,000 public folders apparently, does this mean that every single one of those will break its published link, no matter what we do?
• Can a user find all their files & folders that they have shared to 'anyone with the link'?
• Can there not be an option like 'Remove the security update, but prompt users to review their files and apply to any that they don't want public?

I don't see that we realistically can do anything other than 'remove the security update' at this point.

[vamsi_krishna_p]

• If we choose to 'Remove the security update', will newly published files after September have the new link security anyway?
  • Google has already given the number of affected files and folders. This means it is not going to affect any new files / folders gets created after this
• If we choose to 'Remove the security update', can a user apply it manually to a file?
  • As per the update that's a NO. Google will push the update after Sep 13 to the folders and files links remain same.
• Who would have permission to 'remove the security update' on a file (if the option 'Apply but users can remove it) - is it only the Owner, or can Editors do this?
  • My interactions with google recently on this says that if the user has capability to update this for any document they will see it under the update email or prompt in google drive
• The document says "There’s no option to remove the security update from folders" - we have 23,000 public folders apparently, does this mean that every single one of those will break its published link, no matter what we do?
  • Links for the folder will be changed and for whoever the access is lost they see a request access screen 
• Can a user find all their files & folders that they have shared to 'anyone with the link'?
  • When user is given option to update the security settings google says that they would see the affected files and folders in the drive UI. There is no mention of what type of files they would see etc.. are not mentioned in the update
• Can there not be an option like 'Remove the security update, but prompt users to review their files and apply to any that they don't want public?
  • Not possible as per the instructions provided here

Hope this helps

[tbigby]

Many thanks @vamsi_krishna_p , that will be very helpful feeding through into what we decide to do.

[brian_kim]

sharing this for all the GAM users here to validate information that Google provided. This obviously only scans items in user's My Drive, if you have Shared Drives affected, you will need to go through a few additional steps to get the list of shared drives and organizers (managers) and use that csv to iterate through the items in the shared drive.

gam config csv_output_row_filter "'linkShareMetadata.securityUpdateEligible:boolean:true'" auto_batch_min 1 redirect csv - multiprocess todrive all users print filelist fields id,title,permissions,owners.emailaddress,resourcekey,linksharemetadata,mimetype query "visibility='anyoneWithLink'"

[js14]

What version of GAM is THAT? But thanks for the general reminder about GAM. That command didn't work on our version (and I don't see anything like it in the docs), but hopefully I can muddle through from here.

[brian_kim]

It's GAMADV-XTD3. Try using these python scripts that Ross created. Make
sure that you read and follow the instructions in the comments. Some of the
steps (especially for items in Shared Drives, require creating multiple
CSVs)

https://groups.google.com/g/google-apps-manager/c/sgv3sIIUmOY/m/0fcyRVQ7BwAJ

[CalebSpring]

@brian_kim How do you import/add the scripts to Google Cloud Shell?

[brian_kim]

you can use the IDE that's built in (https://ssh.cloud.google.com), or if you click on the Gear icon, you have an option to upload, download files. or use text editors like nano.  
https://cloud.google.com/shell/docs/uploading-and-downloading-files

[jacob_sollberge]

Does anyone know how/if this will impact internally shared documents across the domain or group if the user has not previously accessed the file?

[johan_olsson]

My understanding is that it would impact files and folders shared internally with "anyone with the link". If the viewer has direct access (shared directly to account or by being part of a group which was included in the sharing) they would still be able to access the file. What I do not know at this point is if that means that they could access the file with the old URL after the new link has been generated or that the file would be only be accessible through shared with me. 

[vamsi_krishna_p]

Hello ,

Can anyone share screenshots of this update looks at the user end? I mean how it provide an option apply the update or remove it etc

Thanks

VK

[bjp384-gadm]

I can share the following comments from Google about the security update.

1. Is Google sending one email per item per user?

[Google] If you apply the security update before July 23, Drive will notify your impacted users so that they can see which files might have changes in access (/may have increased access requests). 

2. Is Google attaching a report of impacted files/folders/shared drive with URLs for each
owner to review their items?

[Google] No. Given the sensitive nature of this information, we aren’t providing a full list of
impacted files, shared drives, and users. You won't be able to determine what files are affected
at this time. However, after Sept 13, 2021, you can search for all files that have the security
update applied by using this advanced search query: ‘is:security_update_applied’ as well as
search for all files that have the security update removed, by using this advanced search query:
‘is:security_update_removed’.

3. How will users apply updates to their impacted folders/files? Will there be a one-click
apply/ don't apply solution (bulk update) for impacted files? Will Drive show a list of
impacted files?

[Google] You, as an Admin, can opt in to have your users choose when to apply these updates
for their own files by changing the “Security update” setting to “Apply security update to all
impacted files” and/or “allow users to remove/apply the security update from files they own or
manage. Opting into this setting will trigger a notification to end-users after July 23rd, 2021 at
which point they will be able to see their impacted files within Drive and can opt in/out for each file.

(no additional information provided on what the user would see to opt in or out for each file)

4. Regarding shared drives, who will be receiving notifications?
[Google] If you choose to opt into notifying your end users, only the manager of a
shared drive will be able to opt in/opt out of applying this security update to affected files.

[ChasL]

So, if I have understood correctly, the update will apply automatically as of 13 Sept, however end users who are notified starting from Jul 26 can manually update the sharing links for the files they own which are affected by this update?

Would admins need to ensure that 'allow security update to all impacted files' is enabled for the above to take place, or will the setting 'Allow users to remove/apply the security update for files they own or manage' need to be enabled also? In an EDU environment, the second option is not recommended, and most tenants would want to have the update applied, and remove that decision making from the end user.

[tbigby]

Does anyone know whether links to enter data into Google Forms will be affected?

I am hoping it will only be if we have shared the form for editing, not the links sent out to fill out the form. We have plenty of published Google Forms as well, across lots of different users.

FYI - I am noticing that some files are beginning to have a resource key appended to them- if I search in My Drive for 'is:security_update_applied' I get some files showing up, but definitely not all files shared as 'anyone with the link'. If I query the link it looks like "https://drive.google.com/file/d/<file ID>/view?usp=sharing&resourcekey=<resourcekey>".

[amira]

Google Support has confirmed on that only non-native Google files will be affected. 

[tbigby]

Thank you Amira!

I really think that hasn't been communicated at all and makes a massive difference to the scale of this problem. We might have made a different plan had that been communicated from the start.

I did some more looking at the files and URLs for my shared files that are listed as 'is:security_update_applied', and the files that aren't listed in there.

I believe dbaker3 is correct - only files created from 2019 and earlier are listed as affected. Even then, some files created in 2019 are not listed either - can't exactly tell when it starts.

Furthermore, if I look at file IDs that are affected, they all start with '0xxx_xxxxxxxx', and those xs are the same in all files I looked at. That means there's only 15 characters that change.

Newer files that don't seem to be affected all start with '1' and any characters after that can change (that includes all Google Docs/Spreadsheets etc). There are 30+ characters that change in those IDs, which suggests that is secure enough to not need a resource key.

Therefore I believe I can tell our teams the following:

• no native Google Docs/Spreadsheets/Slides/Forms are affected
• all files created in 2021 (this school year) are unaffected
• most files created in 2020 are unaffected

Does anyone agree or disagree with that assessment?

Many thanks, Tony

[robyn_bredvick · Accepted solution]

I have been in meetings where a Google employee was present and this is how it was summarized: 

• What is Affected?

• Affected: Non-native Google files added before Nov. 2017

• Not Affected: Google Drive document formats (Docs / Sheets / Slides, etc.)

I do not know if this has been published or been confirmed anywhere though. 

[tbigby]

Thank you robyn_bredvick!

I looked again at my files listed in 'is:security_update_applied' that are in 2019. Turns out those are shared as 'anyone within the group <domain> can view', so they aren't affected.

Given that the affected files are from so long ago, this really reduces the impact for us.

Possibly the only 'native' Google item affected are Folders; I do have one folder from 2017 affected so don't forget about those.

[nicholai]

@robyn_bredvick is correct.