OneDrive’s Overly Friendly File Picker: A Comedy of Errors in Data Exposure
OneDrive File Picker is giving apps a free tour of your entire cloud storage rather than just the files you wanted to share. It’s like inviting a guest for dinner and having them poke around your attic. Oasis Security warns users to review app permissions or risk exposing their digital crown jewels.
Hot Take:
Microsoft’s OneDrive File Picker is like that friend who lets everyone into your house while you’re out of town, claiming it’s just for a quick snack but actually raiding the fridge, rummaging through your closet, and reading your diary. This is a classic case of “who left the keys with the neighborhood kids?” security blunder.
Key Points:
- OneDrive File Picker’s OAuth permissions grant broad access to entire user OneDrives.
- Hundreds of applications could exploit this flaw for complete read/write access.
- Older versions of the File Picker handle OAuth tokens insecurely.
- Consent dialogs fail to convey the extensive access granted to third-party apps.
- Google and Dropbox have implemented more restrictive and safer models.
Already a member? Log in here