Security is for Suckers
September 6, 2006 10:38 PM Subscribe
The Best Hiding Place is Right Out in the Open?
Yes, its a simple Google search. But it returns confidential pdf's and pages from all over the internet. Business plans, powerpoint presentations and other naughty bits exposed to, well, anyone who finds it.
Oops.
Yes, its a simple Google search. But it returns confidential pdf's and pages from all over the internet. Business plans, powerpoint presentations and other naughty bits exposed to, well, anyone who finds it.
Oops.
It's a neat idea, I saw this on www.boingboing.net this morning and spent a half-hour or so looking through search results, but it seems in practice that for anything that's actually "do not distribute", there are dozens of other things that read along the lines of: "The policy states that documents are to be marked 'confidential - do not distribute'".
The most interesting thing I found in my cursory travels was the counsellor rules for a prison counselling program for girls: counsellors are told to keep anything the girls say confidential, and do not distribute condoms.
posted by aeschenkarnos at 10:49 PM on September 6, 2006
The most interesting thing I found in my cursory travels was the counsellor rules for a prison counselling program for girls: counsellors are told to keep anything the girls say confidential, and do not distribute condoms.
posted by aeschenkarnos at 10:49 PM on September 6, 2006
Now I can finally build my very own whatever this thing is.
posted by tepidmonkey at 10:51 PM on September 6, 2006
posted by tepidmonkey at 10:51 PM on September 6, 2006
powerpoint pitches best left behind closed doors. I feel for those who gave these presentations.
"secret underground lair"
there's the reason I haven't seen any furries around lately.
posted by carsonb at 10:57 PM on September 6, 2006
"secret underground lair"
there's the reason I haven't seen any furries around lately.
posted by carsonb at 10:57 PM on September 6, 2006
That's wonderful. People have this naive belief that links they don't deliberately publicize won't get spidered. But sooner or later it's quite likely a search engine will find it -- in someone's public referrer log, or because you didn't disable directory listings, or somewhere down in the long, unedited history of an email message that eventually found its way onto a publicly archived mailing list.
If you must put something on the web that you don't want made public, you have to secure it using honest-to-god access control (which is not exactly difficult). But even then, somebody may just lose track of a copy which gets posted somewhere public.
posted by George_Spiggott at 11:03 PM on September 6, 2006
If you must put something on the web that you don't want made public, you have to secure it using honest-to-god access control (which is not exactly difficult). But even then, somebody may just lose track of a copy which gets posted somewhere public.
posted by George_Spiggott at 11:03 PM on September 6, 2006
Wow... if Im not mistaken thats the final schematic for a nuclear warhead trigger mechanism...either that or a Dairy Queen soft whip dispenser...:::turns schematic over:::
posted by Muirwylde at 11:03 PM on September 6, 2006
posted by Muirwylde at 11:03 PM on September 6, 2006
I once got a job from someone who googled an old, unlinked resume of mine, hosted on a backwater ISP that I'd forgotten about entirely, and called me up. Nothing is safe, though in that case it was a good thing.
posted by jimmythefish at 11:20 PM on September 6, 2006
posted by jimmythefish at 11:20 PM on September 6, 2006
I don't know about posting google searches. But I'd love to see "Secret Underground Lair" vs. "Not for Public Release" deck it out over at googlefight. In fact.... here.
(the results are shocking!)
posted by punkbitch at 11:33 PM on September 6, 2006
(the results are shocking!)
posted by punkbitch at 11:33 PM on September 6, 2006
oy! what fun... but thanks for hours of joyful browsing...
posted by infini at 11:40 PM on September 6, 2006
posted by infini at 11:40 PM on September 6, 2006
Ninjas long have known the best place to hide is out in the open. Or as... cheerleaders. Whichever one. They're both good.
posted by damn dirty ape at 11:49 PM on September 6, 2006
posted by damn dirty ape at 11:49 PM on September 6, 2006
"company confidential" works decently as well... I've been limiting by PDF.
I'll say I'm a bit disturbed by how many items I was afraid to click, overall.
posted by VulcanMike at 12:05 AM on September 7, 2006
I'll say I'm a bit disturbed by how many items I was afraid to click, overall.
posted by VulcanMike at 12:05 AM on September 7, 2006
In my experience, every document template in every large company on the planet contains some mention of confidentiality.
posted by coelecanth at 12:26 AM on September 7, 2006
posted by coelecanth at 12:26 AM on September 7, 2006
...although my survey isn't totally complete.
posted by coelecanth at 12:31 AM on September 7, 2006
posted by coelecanth at 12:31 AM on September 7, 2006
inurl:CgiStart?page=Single
axis inurl:view/index.shtml
posted by Sukiari at 12:51 AM on September 7, 2006 [1 favorite]
axis inurl:view/index.shtml
posted by Sukiari at 12:51 AM on September 7, 2006 [1 favorite]
Not to spoil the fun, but the first search hit is also linked from the official company site, so it is probably to be considered declassified.
posted by Herr Fahrstuhl at 2:04 AM on September 7, 2006
posted by Herr Fahrstuhl at 2:04 AM on September 7, 2006
Google Hacking database is what you meant to post.
posted by about_time at 4:46 AM on September 7, 2006
posted by about_time at 4:46 AM on September 7, 2006
I'll say I'm a bit disturbed by how many items I was afraid to click, overall.
Oh come on, take some chances. Hold on, someone knocking at the door ...
posted by itchylick at 5:02 AM on September 7, 2006
Oh come on, take some chances. Hold on, someone knocking at the door ...
posted by itchylick at 5:02 AM on September 7, 2006
If you are a programmer "proprietary source code" is also good for a few laughs.
posted by localroger at 5:53 AM on September 7, 2006
posted by localroger at 5:53 AM on September 7, 2006
thats the final schematic for a nuclear warhead trigger mechanism...either that or a Dairy Queen soft whip dispenser
They are one and the same. In the final moments before an atomic blast individuals at ground zero are treated to delicious soft ice cream treats.
posted by CynicalKnight at 6:14 AM on September 7, 2006
They are one and the same. In the final moments before an atomic blast individuals at ground zero are treated to delicious soft ice cream treats.
posted by CynicalKnight at 6:14 AM on September 7, 2006
Is this really a link to "something cool on the web"? If it was a link to an article about this (apparently) common security flaw, maybe; as it is, this is only a link to a google search which will inevitably change over time.
posted by yhbc at 7:49 AM on September 7, 2006
posted by yhbc at 7:49 AM on September 7, 2006
Sukiari: "inurl:CgiStart?page=Single
axis inurl:view/index.shtml"
Wow, that's neat. I just watched some guy buy something in a hardware store.
posted by mindless progress at 8:11 AM on September 7, 2006
axis inurl:view/index.shtml"
Wow, that's neat. I just watched some guy buy something in a hardware store.
posted by mindless progress at 8:11 AM on September 7, 2006
electronics store. If I was that guy I'd totally wear a chicken suit.
Lazyweb: someone needs to make a fake security cam that is actually a flash video that shows aliens landing in the background or something.
posted by craniac at 8:21 AM on September 7, 2006
Lazyweb: someone needs to make a fake security cam that is actually a flash video that shows aliens landing in the background or something.
posted by craniac at 8:21 AM on September 7, 2006
Heh, i love net voyeurism!
guinea pig cam!
posted by TechnoLustLuddite at 8:37 AM on September 7, 2006
guinea pig cam!
posted by TechnoLustLuddite at 8:37 AM on September 7, 2006
Once, a long time ago, I worked for a company that did some contract work for a large blue computer firm. We were working on a product that hadn't been released yet, and all the documentation was stamped "BLUE CONFIDENTIAL: DO NOT DISTRIBUTE".
When the product was released, staff from Blue arrived, counted our "confidential" documentation to make sure it was all accounted for, shredded it, and gave us new documentation which was identical except that it was NOT stamped confidential.
This obviously eliminates the problem of trying to determine if they really want that "confidential" document linked to the company home page or not.
posted by djfiander at 8:46 AM on September 7, 2006
When the product was released, staff from Blue arrived, counted our "confidential" documentation to make sure it was all accounted for, shredded it, and gave us new documentation which was identical except that it was NOT stamped confidential.
This obviously eliminates the problem of trying to determine if they really want that "confidential" document linked to the company home page or not.
posted by djfiander at 8:46 AM on September 7, 2006
Re: not exactly difficult Posted by George_Spiggott
And there is always <meta name="Robots" content= "noindex, nofollow">
posted by Schroder at 8:48 AM on September 7, 2006
And there is always <meta name="Robots" content= "noindex, nofollow">
posted by Schroder at 8:48 AM on September 7, 2006
Is this really a link to "something cool on the web"?
Yep, it is. I, for one, would like to form my own opinions about things instead of reading regurgitated pap from media hacks all the time.
posted by Kickstart70 at 8:55 AM on September 7, 2006
Yep, it is. I, for one, would like to form my own opinions about things instead of reading regurgitated pap from media hacks all the time.
posted by Kickstart70 at 8:55 AM on September 7, 2006
Is this really a link to "something cool on the web"? If it was a link to an article about this (apparently) common security flaw, maybe; as it is, this is only a link to a google search which will inevitably change over time.
posted by yhbc
You're right--it can't be cool unless I know from someone else what to think.
On preview--what Kickstart70 said.
posted by leftcoastbob at 9:14 AM on September 7, 2006
posted by yhbc
You're right--it can't be cool unless I know from someone else what to think.
On preview--what Kickstart70 said.
posted by leftcoastbob at 9:14 AM on September 7, 2006
You're missing my point, which was not that anyone needs to be told what to think, but that this post breaks the posting guidelines.
Sorry I confused both of you by trying to be polite and not derail the thread. I won't make that mistake again.
posted by yhbc at 9:40 AM on September 7, 2006
Make sure you're linking to something on the web. If you're posting a generalized question to the audience, or posting a comment as a main thread, either find an appropriate mailing list, or use MetaTalk.My question was rhetorical - it is not a link to "something cool on the web" (which is another quote from the posting page), but an example of a google search. Although it may warrant discussion, it does not belong here.
Sorry I confused both of you by trying to be polite and not derail the thread. I won't make that mistake again.
posted by yhbc at 9:40 AM on September 7, 2006
Oy, I was waiting for this to show up on the blue. One of my clients has a PDF in the first page of search results, and we had a little chat shortly after the BB article went up about how "with FTP access comes great responsibility".
"The policy states that documents are to be marked 'confidential - do not distribute'".
This was true in my client's case, and the "confidential" materials were actually part of a very public press campaign some years ago. We think the document in question had been linked via a news posting at the time (laziness on PR's part, or an inability to generate a "clean" PDF).
On the plus side, they hit their daily average of hits for the day before 10am.
posted by Sangre Azul at 9:46 AM on September 7, 2006
"The policy states that documents are to be marked 'confidential - do not distribute'".
This was true in my client's case, and the "confidential" materials were actually part of a very public press campaign some years ago. We think the document in question had been linked via a news posting at the time (laziness on PR's part, or an inability to generate a "clean" PDF).
On the plus side, they hit their daily average of hits for the day before 10am.
posted by Sangre Azul at 9:46 AM on September 7, 2006
When the product was released, staff from Blue arrived, counted our "confidential" documentation to make sure it was all accounted for, shredded it, and gave us new documentation which was identical except that it was NOT stamped confidential.
As was explained to me many, many, many, many, many (you have no idea how many more manys I could conceivably write here and not be exaggerating) whilst I worked there, when maintaining a confidential documents policy it's just as important to ensure that non-confidential information is not marked confidential as it is to ensure that confidential information is marked as such. It had to do with lawsuits over trade secrets or industrial espionage or somesuch.
posted by jacquilynne at 11:08 AM on September 7, 2006
As was explained to me many, many, many, many, many (you have no idea how many more manys I could conceivably write here and not be exaggerating) whilst I worked there, when maintaining a confidential documents policy it's just as important to ensure that non-confidential information is not marked confidential as it is to ensure that confidential information is marked as such. It had to do with lawsuits over trade secrets or industrial espionage or somesuch.
posted by jacquilynne at 11:08 AM on September 7, 2006
Now I can finally build my very own whatever this thing is.
Check those plans again. They responded.
posted by oraknabo at 11:34 AM on September 7, 2006
Check those plans again. They responded.
posted by oraknabo at 11:34 AM on September 7, 2006
Adding "site:.gov" is an interesting variation. A lot of the searched documents are just policies about confidential documents. But not all of them.
Now I can finally build my very own whatever this thing is. - tepidmonkey
Check those plans again. They responded. - oraknabo
At least they have a sense of humour about it. Some managers would go on some kind of crusade about how the internets are ruining civilisation.
posted by raedyn at 12:30 PM on September 7, 2006
Now I can finally build my very own whatever this thing is. - tepidmonkey
Check those plans again. They responded. - oraknabo
At least they have a sense of humour about it. Some managers would go on some kind of crusade about how the internets are ruining civilisation.
posted by raedyn at 12:30 PM on September 7, 2006
Sorry I confused both of you by trying to be polite and not derail the thread. I won't make that mistake again.
Actually the flaw was in your use of the word 'article', which was even emphasized in italics. If you hadn't used that, we wouldn't have assumed that you wanted an article, thinking that it was better than linking to a Google search.
</desnark>
posted by Kickstart70 at 12:43 PM on September 7, 2006
Actually the flaw was in your use of the word 'article', which was even emphasized in italics. If you hadn't used that, we wouldn't have assumed that you wanted an article, thinking that it was better than linking to a Google search.
</desnark>
posted by Kickstart70 at 12:43 PM on September 7, 2006
I got a kick out of the sponsored ad:
Sponsored Links
Protect Confidential Data.....
posted by x_3mta3 at 4:01 PM on September 7, 2006
Sponsored Links
Protect Confidential Data.....
posted by x_3mta3 at 4:01 PM on September 7, 2006
I don't think google searches are categorically excluded from "something cool on the web".
unless....uh, what do you mean by "something"?
posted by carsonb at 7:15 PM on September 7, 2006
unless....uh, what do you mean by "something"?
posted by carsonb at 7:15 PM on September 7, 2006
Check those plans again. They responded.
Feh. I was hoping they'd added a "Hobnostic Defrosticator" or "Framistat" label.
posted by lekvar at 7:36 PM on September 7, 2006
Feh. I was hoping they'd added a "Hobnostic Defrosticator" or "Framistat" label.
posted by lekvar at 7:36 PM on September 7, 2006
So I take it no one found anything really freaky, eh?
posted by five fresh fish at 8:06 PM on September 7, 2006
posted by five fresh fish at 8:06 PM on September 7, 2006
Just that photo of you naked with a wombat, fff. Otherwise, nothing good.
posted by caution live frogs at 9:55 PM on September 7, 2006
posted by caution live frogs at 9:55 PM on September 7, 2006
A wombat? Good. S'alright, then.
posted by five fresh fish at 8:39 AM on September 8, 2006
posted by five fresh fish at 8:39 AM on September 8, 2006
« Older Resistance is Futile. Or Maybe Not. | Fake ferrit fur Newer »
This thread has been archived and is closed to new comments
posted by Kickstart70 at 10:46 PM on September 6, 2006