Is there an easy way to know if I'm vulnerable to this? Like some dashboard page that lists all the API keys with "revoke" buttons?
I did something or another with a google API years ago, and am not looking forward to a random surprise bill. They don't have my credit card, so maybe that'd solve the problem. On the other hand, they could hold a gmail account hostage.
You should definitely log in to Google Cloud Console and roll all the keys you see in there if you're unsure. I just did the same thing after I realized I had a lot of surface area with these keys.
I really hope that one effect of ai code generators making code cheaper to write is that the calculus around "accept vendor lock in return for getting up and running faster" changes dramatically
This is interesting but the linked articles is even more interesting.
https://trufflesecurity.com/blog/google-api-keys-werent-secr...
> Even Google themselves had old public API keys, which they thought were non-sensitive, that we could use to access Google’s internal Gemini.
This is just a classic slow clap here for Cloud.
Some more discussion: https://news.ycombinator.com/item?id=47156925
Is there an easy way to know if I'm vulnerable to this? Like some dashboard page that lists all the API keys with "revoke" buttons?
I did something or another with a google API years ago, and am not looking forward to a random surprise bill. They don't have my credit card, so maybe that'd solve the problem. On the other hand, they could hold a gmail account hostage.
You should definitely log in to Google Cloud Console and roll all the keys you see in there if you're unsure. I just did the same thing after I realized I had a lot of surface area with these keys.
I really hope that one effect of ai code generators making code cheaper to write is that the calculus around "accept vendor lock in return for getting up and running faster" changes dramatically
[dead]
[dead]