Google's insecure-by-default API keys and 30h billing lag cost my startup $15k(old.reddit.com)
53 pointsby tertervat9 hours ago5 comments
  • kingstnap6 hours ago
    This is interesting but the linked articles is even more interesting.

    https://trufflesecurity.com/blog/google-api-keys-werent-secr...

    > Even Google themselves had old public API keys, which they thought were non-sensitive, that we could use to access Google’s internal Gemini.

    This is just a classic slow clap here for Cloud.

  • hedora6 hours ago
    Is there an easy way to know if I'm vulnerable to this? Like some dashboard page that lists all the API keys with "revoke" buttons?

    I did something or another with a google API years ago, and am not looking forward to a random surprise bill. They don't have my credit card, so maybe that'd solve the problem. On the other hand, they could hold a gmail account hostage.

    • drewnick5 hours ago
      You should definitely log in to Google Cloud Console and roll all the keys you see in there if you're unsure. I just did the same thing after I realized I had a lot of surface area with these keys.
  • zem7 hours ago
    I really hope that one effect of ai code generators making code cheaper to write is that the calculus around "accept vendor lock in return for getting up and running faster" changes dramatically
  • cumshitpiss7 hours ago
    [dead]
  • opsdu8 hours ago
    [dead]