•

Google adds tracking to Google docs documents?

Joe :fedora: :debian: :ferris: (@Joe_0237@fosstodon.org)

https://fosstodon.org/@Joe_0237/111145684757912952

Today I found out that google docs infects html exports with spyware, no scripts, but links in your document are replaced with invisible google tracking redirects. I was using their software because a friend wanted me to work with him on a google doc, he is a pretty big fan of their software, but we were both somehow absolutely shocked that they would go that far.

Title says it all. Somewhat interesting if true. I wouldn't be surprised either way.

12 comments

Moonrise2473

•

The idea didn't have an evil origin.

There are scammers that are sending phishing links inside a Google docs drive as in this way it's less likely to get blocked by spam filters. Like "your statement is ready and you're eligible for a refund, click here to check"

By mass replacing all the links with a Google redirect, (it shows the original one but when you click it changes), Google now can block those scam domains

The side effect is that now the system can be used to collect all the visit stats. But maybe they're not tracking visits as they can already get full browser histories from Google chrome users with account sync, and that's enough data

infinull

•

Those aren't HTML exports though? Those are direct links to google docs.

jarfil

•

First, scammers used to set up a Google docs with a survey inside Google for users to fill out. Google cracked down on those.

Then, scammers started adding external links to Google docs,so people would see the doc was on Google and trust to click on the link. Google cracked down on those.

Now, scammers are exporting the Google docs webpage and hosting it somewhere else, so it still looks like Google and makes people trust it, but outside of Google's control. Google is now cracking down on those by replacing every link with a redirect through Google,.so olevwn if the HTML export isnhosted somewhere else, Google gets to scan and block malicious links.

Personally I'm against it (tampering with user data) and I think it's only going to stop the scammers who forget to replace the exported links, which seem like an easy thing to do.

infinull

•

Sorry if this sounds combative, but I just don't think I'm understanding what's going on, I can't figure out how this could possibly work.

How does that even work though? Like... the exported doc is just a web page, it doesn't have any google watermarks (except the now invisible ones) marking it as a google web page.

If it's hosted on an external domain... it doesn't have the google domain in the URL bar either...

Like how is the scam victim fooled vs a normal web page with the same information... How is a google docs HTML export visually different from a LibreOffice or Microsoft Office HTML export in a way that tricks the scam victim into thinking it's legitimately from Google and therefore laundering the scammers reputation through Google. Like I know scam victims are generally distracted or otherwise not thinking clearly (or just dumb), but how does this work?

Besides the default font basically any Word Processor HTML export looks the same to a layman, it's plain black text on a white background with 1in margins. If scam victims trust plain white backgrounds and simple formatting there's a ton of ways to achieve that effect that bypass Google.

jarfil

•

Let's see...

HTML exports are not plain text, they include images, graphs, formatting, tables, links, etc. Google docs is a HTML based editor, so its HTML exports look particularly similar to the original editable doc, which users are used to. Other editors have different looks, and their HTML exports look differently.

Just like scam victims are "dumb", many scammers are also "dumb", they barely grasp the technical part of what they're doing, some just follow a script, but most importantly their focus is on social engineering, not on the tech.

How it works is: a "dumb" scammer writes a Google doc with some links to some scam landing page, gets a HTML export, and hosts it on gōogle.com; a "dumb" victim comes by, thinks "oh, this looks similar to the TPS report from last month", clicks on a link, and proceeds to fill in their company's banking information... ✨ well, not anymore! Because Google has replaced the actual link with a redirect in the HTML export that they scan and block when reported to be used by scammers. 🎉

Silly measures against silly scammers of silly victims. 🤷

sculd

•

Not surprised at all and proved that Degoogle is not only a choice but necessity. I used have a lot of documents saved as Google docs. Feels much better now just using LibreOffice.

Karlos_Cantana

•

Do you have shared spreadsheets? I've been trying to find an alternative to Google Sheets, but I've not found one yet. Someone had suggested Disroot, but the spreadsheet doesn't work well with Android.

sculd

•

Spreadsheet is a difficult one. I do not have an alternative of a spreadsheet that can be actively edited by multiple people.

Instead I just go back to sending files which works well for most of the use cases. That is a trade off that I decided to make but understand that not everyone can make that trade off.

yum13241

•

Self-hosted ONLYOFFICE anyone?

aniki

•

Quexotic

•

Neat. I wonder how that would run on my potato computer.

aniki

•

Quexotic

•

My server is an old precision. Very old. New SSD though, so it could maybe pull it off.

aniki

•

Quexotic

•

Yeah, I don't run it much because of the power cost. I can't find a pi at retail though, and now that I have kids, don't have time to mess with that anyhow. I do have a zero w that I got for $10 though and it's a fun little toy.