OneDrive’s Open Door: The Perils of Over-Permissioned Apps on Your Files
Web apps using OneDrive’s File Picker might be snooping on all your files, not just the ones you upload. Oasis Security research lead Elad Luz rings the alarm, saying this lapse breaks the least privilege rule. While Microsoft ponders, consider this: your OneDrive might be an open book for clever web apps.
Hot Take:
OneDrive, are you trying to give us all a heart attack? It seems like the File Picker is a bit too generous, handing out all-access passes like they’re candy at a parade. Maybe it’s time for Microsoft to swap those permission slips for something a little less like an all-you-can-eat buffet. And users, let’s not just click “yes” to everything like we’re on a game show. Your files are not the prize behind door number three!
Key Points:
- OneDrive’s File Picker demands broad read access, exposing all user files.
- User consent dialogs are vague, leading to unintentional data exposure.
- Apps like ChatGPT, Slack, and Zoom are affected by this issue.
- Google Drive and Dropbox offer more refined permission scopes.
- Security experts recommend stricter admin consent and data protection policies.
Already a member? Log in here