|Security Scare: Complete unknown stranger requesting access to a private non published document||trunky||8/10/10 12:29 PM|
I have a personal document which i created a year ago and it is totally private except to me and 1 other collaborator who has not accessed this document for over 6 months.
I have just worryingly received an email from "trix.bounces.google.com" with the subject: "Requesting access to XXX (Google Docs)" from an email address / person I have never met or known - a complete stranger
XXX XXX, at XX...@gmail.com requests access to the document called "XXX":
You are the owner of this document. To give this user access, click the link above and add them as a collaborator or viewer.
Firstly I have never ever made this document public - how did this unknown stranger even know this document existed??!
Secondly how were they able to make a request to me to share this document with them??!
Please help! I will need to remove all my private personal documents from google in case anyone can access them even though I made them private from the start..
What browser and OS are you using? Chrome / Win 7
If your question is about documents or spreadsheets, were you using the new version? Using classic
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||Gill||8/11/10 8:55 AM|
The good news is that this person won't be able to access the doc without your permission. I cannot say how they came across the URL - did you ever refer to it on a website somewhere? Maybe they were just trawling randomly.
<<I will need to remove all my private personal documents from google in case anyone can access them even though I made them private from the start.>> I don't think that will be necessary so long as you are certain you haven't shared the docs, they are private, and if you have shared them you have turned off the setting that allows collaborators to change permissions.
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||TechTanya||9/13/10 1:05 AM|
This just happened to me too! I just created a private spreadsheet and shared it with 3 other people.
Less than an hour later I got an same email letter saying: Anthony HXXXX, at Xxxxx...@gmail.com requests access to the document called "XXXXX"
How did this person even know the spreadsheet existed (it was only 40 minutes old), much less the name?
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||Gill||9/13/10 9:22 AM|
What permission did you have at the bottom? "
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||TechTanya||9/17/10 1:01 AM|
Thanks Gill, I changed it to "only owner" as soon as I saw that email request come in. The only Anthony I know is a family member and I did share the doc to him, but I know it was his email addy when I hit send (it was the only non-google address). You think maybe it was because they shared the same name? But I was so spooked I deleted my family member Anthony from the doc too. I doubt he shared it due to timezones, and the other persons I shared it with were sitting next to me and not on a computer.
Ideas? I appreciate the help!
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||Gill||9/17/10 12:50 PM|
Um, I wonder if your Anthony had some kind of auto-forward on his email, so that what you saw in the doc sharing was in fact one of his accounts? Can you ask him? That would explain it and put your mind at rest. Otherwise I'm afraid I don't know - I am not an expert in sharing and what can go wrong - but I am careful going on paranoid and always stick to the most restrictive sharing options!
|Re: Security Scare: Complete unknown stranger requesting access to a private non published document||trunky||9/23/10 2:50 PM|
Further to my original security scare posting. I have a theory how this stranger got to access the specific URL that linked to my private (and never shared) document. On further investigation of this stranger's email - I found out this person owns the website to which my document had a link to. In my document I have hyperlinks to a load of websites. And this person it turned out owned one of these websites.
I have a theory (as yet untested as I don't have time to set up my own webserver blah blah) that as my document linked to his website, and I clicked on it via the google document link, his webserver logs or whatever captured where the source of the link came from. And this probably presented itself from my private google document.
So maybe in his webserver logs he saw some referral from e.g. http://spreadsheets.google.com/ccc?key=XXXXXXXXX
I am presuming that all google documents private or not have a specific key to them and it is up to you whom you wanna share it with. So even if it's private, if someone gets hold of the key, then they know it exists. If it's private they can't access it without your explicit permission, which is why we get those "scary" emails for request to access.
The scary thing is I don't know if they know what the title of our compromised documents are called. Hopefully google dosen't reveal this, but I wouldn't bet on anything on this!
The summary of my (at the moment totally untested, but one i have much confidence in ) theory - is that if you have google documents and it's private and you wanna keep it that way do the following:
1) Name the document cryptically e.g. not Adam's secret finance funds
2) Do NOT hyperlink any URLs in there, if you need to put links, do e.g. www<space>.blah<space>.com so it dosen't auto create hyperlink. Also go to the links by manually entering the address.