Google General Counsel Halimah Delaine Prado joins 'Fox & Friends' to detail how Google is fighting AI-powered phishing scams.
Passwords have a way of ending up in places they were never meant to live. Sometimes convenience wins in the moment, and security becomes tomorrow's problem. One company learned that lesson after a contractor stored credentials in a Google Doc so they could access them from different devices.
Then something happened that should make anyone who uses Google Docs take a closer look at their sharing settings. A developer searching the company's domain on Google saw one of its staging hostnames appear in autocomplete alongside what looked like a credential string. The company investigated and found a Google Docs URL that anyone with the link could access.
That's a rough way to discover that a password has traveled much farther than you intended. Here's how the exposure happened, what Google says about Docs privacy and the simple steps you can take to keep your own passwords and shared files safer.
New! Free live CyberGuy class: Protect Your Money from Today’s Biggest Threats
Join us Saturday, Aug. 29, at 10 a.m. ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt "CyberGuy" Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You’ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
WORLD PASSWORD DAY: CHECK IF YOUR PASSWORDS ARE SAFE
A computer screen displaying text related to a Google Docs password leak security incident. (Kurt "CyberGuy" Knutsson)
The story was reported by The Register and comes from Siim Kostabi, co-founder of Pageloot, a company that provides QR codes for businesses. Kostabi said his company brought in an outside contractor to help with back-end API integrations. The contractor had credentials for the company's staging environment, which is essentially a test version of its system.
The contractor wanted easy access to those credentials from multiple devices. So they put the information into a Google Doc and set the document so anyone with the link could view it. Later, a Pageloot developer was working on an unrelated problem and typed the company's domain into Google Search. Autocomplete surfaced one of the staging hostnames followed by what appeared to be a credential string.
The team checked and found the accessible Google Docs URL. The Register reported that Google Search had indexed the document and offered information from it as a search suggestion. Pageloot quickly cut off the contractor's access and rotated the exposed credentials. The company also adopted a rule against storing passwords in Google Docs, Slack or Notion and other collaboration tools.
Before you start worrying that every Google Doc you have ever created could suddenly appear in a search, there is an important piece of context. Google told CyberGuy that Google Docs are restricted by default. The person who creates the document controls how it gets shared.
Google's current Drive guidance says Restricted means only people with access can open a file. If you select Anyone with the link, anyone who gets that link can use the file without signing in to a Google Account. Google separately lists a Public setting, when available, that allows anyone to find the file through Google Search.
Google also told CyberGuy that a link to a publicly shared Doc may be indexed if someone posts that link somewhere public where a search engine crawler can find it. The Register says the Pageloot document eventually surfaced through Google Search autocomplete. However, the report does not explain how Google first discovered the Docs URL. For the rest of us, the useful lesson is simple: pay attention to the sharing setting before putting anything sensitive in a cloud document.
