Google Drive as data source asks for FULL access to ALL user's files on Drive
Google Drive as data source asks for FULL access to ALL user's files on Drive
0 vote
Problem
When using Google Drive as a data source, the user must grant access to their entire Google Drive account.
Expected Behavior
Users should only have to authorize the app to access its own files (i.e. RDM can create files on your Drive and only see those).
Notes
I've reached out to Devolutions a couple of times about this but no luck in getting the "feature" prioritized. This seems like a HUGE security issue so I'll continue using the local filesystem until it gets fixed.
Thanks!
All Comments (20)
Hello,
Thank you for posting your request, I have linked it to our internal ticket to change the Google permissions (RDMW-8016). I do not have an ETA yet when this will be implemented, however.
In the meantime, you may be interested in Devolutions Hub Personal, which is hosted by us in Azure, and is free to use. It is faster than the Google drive data source, provides you with a web interface when you do not have access to RDM, and more. You can refer to https://devolutions.net/password-hub/personal for more details.
Best regards,
Richard Boisvert
Hello,
Thank you for posting your request, I have linked it to our internal ticket to change the Google permissions (RDMW-8016). I do not have an ETA yet when this will be implemented, however.
In the meantime, you may be interested in Devolutions Hub Personal, which is hosted by us in Azure, and is free to use. It is faster than the Google drive data source, provides you with a web interface when you do not have access to RDM, and more. You can refer to https://devolutions.net/password-hub/personal for more details.
Best regards,
Thanks! Any luck or timeline with RDMW-8016?
Hello,
It is still in the backlog of the engineering team, unfortunately. I will ask them to increase the priority.
Best regards,
Richard Boisvert
Hello,
No we don't have any update, the issue is still in the backlog.
We have reprioritized the issue
Best regards,
Michel Lambert
Hey Folks,
This, unfortunately, is still killing me. I'm honestly somewhat shocked that this issue with permissions hasn't gained more attention. It is a HUGE security risk to link any app (regardless of who develops it) to Google Drive (or any cloud storage provider) with full access to ALL content. From my point of view, I worry about someone discovering a vulnerability in the RDM <--> Google Drive connector and then being able to expose folks' data stored on their Google Drive account. This should be a large concern for Devolutions, one would think. I'm assuming Google devs may even be able to help since this is a common scenario.
Please do not take this as me being upset. I LOVE RDM and all Devolutions products but I am 1) slightly frustrated that I still have to manually sync items or switch to Devolutions Hub Personal and 2) concerned for Devolutions' sake in the event of a data breach via this very issue.
Thanks,
Tyler
Additional resource: https://developers.google.com/drive/api/guides/api-specific-auth
Hello,
Sorry for the late reply.
We opened a ticket with our developers and security team to improve/rework this integration to require less permissions.
Thank you for posting.
Best regards,
Jeff Dagenais
Thank you, Jeff!