alt Hacker NewsGoogle API keys weren't secrets, but then Gemini changed the rules
Comments
[dead]
[flagged]
ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.
Private data should not be allowed to be accessed using public keys. That is the core problem. It is not about Google API keys are secret or not.
Explain It Like I'm Five.
From TFA:
> Last month, a developer on your team enabled the Gemini API for an internal prototype. > The result: thousands of API keys that were deployed as benign billing tokens are now live Gemini credentials sitting on the public internet.
Benign, deployed openly without any access restrictions whatsoever, billing tokens can be used to bill for a service under the account it is enabled for. That's the intended behavior, literally. Maps API keys are used to give your users access to Google Maps on your credit card.
What's the problem here? Yes, the defaults could have been stricter, but it's not like it costs anything to create a bunch of internal projects that do not have good-for-billing access keys floating around open internet. People moved fast, deployed LLM generated code, broke things and then blame everyone else but themselves?
[dead]