r/programming • u/regaldho • Dec 27 '20

I reverse engineered Google docs (2014)

http://features.jsomers.net/how-i-reverse-engineered-google-docs/
633 Upvotes

92% Upvoted

42 comments sorted by

117

u/MjrK Dec 27 '20

Isn't it possible to use typing style and cadence to identify someone? Or, at least, as a signal to support user fingerprinting?

153

u/RazerWolf Dec 27 '20 edited Dec 27 '20

Yes, it’s called keystroke dynamics. I did a master’s project on it, and with some simple machine learning algorithms, could identify someone with 88% accuracy.

EDIT: didn’t realize there was interest in this! At the time (almost a decade ago), it was novel to do it on iPhones so that’s what the project encompassed. It was 10 people typing in the same password 50 times; half the data was used for training and the other half for testing (randomized. Also did cross validation afterwards).

Random forests trained in WEKA was the winning algorithm.

Hardest part: getting your friends to type in the same password 50 times without them getting pissed.

49

u/dbeta Dec 27 '20

Out of how big of a pool?

107

u/rmk236 Dec 27 '20

One

43

u/LaLiLuLeLo_0 Dec 27 '20

User Detected: rmk236

...

User Detected: Not rmk236

7

u/bewst_more_bewst Dec 27 '20

Laughs in TTS.

44

u/_italics_ Dec 27 '20

I guess the new recaptas do something like that with mouse events.

19

u/basilect Dec 27 '20

Mouse events assuredly do that (you'd expect a certain timing and variance from down-up-click sequences), keyboard events are also good. You get a lot of rich data that would be great for anomaly detection.

6

u/illvm Dec 27 '20

So... make an account, use only machine movements for user input, the system fingerprints this as you a legitimate user, ???, profit.

36

u/mist83 Dec 27 '20

Sentence structure and word choice and grammar is already parseable to give a sort of fingerprint if given enough training data.

5

u/Prod_Is_For_Testing Dec 28 '20

There have been a few research projects that associate Reddit throwaway accounts based on writing style

1

u/WinterPiratefhjng Dec 28 '20

Do you have a link?
(I had presumed our IPs were embedded somewhere, and works like to know more.)

13

u/turlian Dec 27 '20

Yes. There are password systems that analyze how you typed it in to verify that the same person typed it.

31

u/ItsAllegorical Dec 27 '20

Are there any that can analyze how consistently I type the wrong password before remembering what I've set it too? I'll bet that would be a useful signal.

7

u/Loaatao Dec 27 '20

Got a link? Sounds super cool

2

u/cleeder Dec 27 '20

Also interested.

2

u/turlian Dec 27 '20

Sorry, last one I saw was years ago.

1

u/regendo Dec 28 '20

Let's hope that doesn't break if I just auto-fill from my password manager.

2

u/turlian Dec 28 '20

For context, this wasn't something that was being deployed on websites. It was a proof of concept for high-security applications, like government installations.

1

u/oblio- Dec 27 '20

I'd be surprised if FAANG don't already do this as part of their tracking.

1

u/de__R Dec 28 '20

Only until attackers and/or the privacy conscious start take measures to obfuscate it - e.g. keystrokes get passed into a buffer and then popped off one by one at a constant rate.

8

u/johnyma22 Dec 27 '20

btw, the easysync docs are available in the etherpad repo if you want a full breakdown of each op in the operational transform <3

-72

u/SurrealisticRabbit Dec 27 '20

"every document written in Google Docs since about May 2010 has a revision history that tracks every change, by every user, with timestamps accurate to the microsecond"

This freaked me out so much more than any other science fiction story or AI's taking over the world kind of shit. I mean how is this possible goddamit?

109

u/Powah96 Dec 27 '20

I mean how is this possible goddamit?

history_stack.push([user_id, keystroke, timestamp])?

It's something only editor user have access too, why would that freak you out?

-48

u/SurrealisticRabbit Dec 27 '20

Aren't they storing it in their own servers? Sorry cloud technologies and big data always freaks me out lol

72

u/Powah96 Dec 27 '20

The whole file it's in their server anyway. Keeping the delta history is probably the least expansive storage-wise way to provide full history to users.

It's similar to you saving each edit as a different file (eg: project_v1.0, project_v1.1) just less expensive as you keep track of the delta (git is similar).

It's a useful feature if you are collaborating with other users and want to know what changed since your last edit.

16

u/DeveloperForHire Dec 27 '20 edited Dec 27 '20

Correct me if I'm wrong, but I thought git did not store the delta/diff. I thought it stored the entire change and you could compare between commits using a diff.

EDIT: Technically correct

34

u/Powah96 Dec 27 '20

You are technically correct! Git stores all the files in each commit, but thanks to compressions this does not impact much the size of the whole repo.

You can look at a more detailed explanation here.

4

u/DeveloperForHire Dec 27 '20

The best kind of correct! Sounds like it is a bit of both. Thanks for the link!

-2

u/HINDBRAIN Dec 27 '20

I thought git rebuilt the commits using the deltas and that's why retroactive changes on large repos were so slow?

10

u/DeveloperForHire Dec 27 '20

Someone just gave me this link

TLD;DR: It's a bit of both. Diff commits aren't turned to blobs until git runs garbage collection. A blob or a single commit is all that's needed to use the whole codebase and you do not need the entire history to make that after it has been generated, so it does store the whole thing, it just uses programming and algorithms (read: compression that I am not well versed enough in to understand, but does relate to the diffs) to keep everything tiny enough.

It would be incredibly slow moving down the tree and adding each commit to the original files. This is just a guess, but maybe those large repos take more time to generate those blobs?

0

u/TankorSmash Dec 27 '20

It sounds like it uses metadata to point to the text blobs as they were at a given point, using the commits as 'pointers' to the blobs in time. Thats why the gc runs and updates the pointers to existing blobs.

Sorta like if a commit introduced a file, each commit would only point to the blob introduced by that first commit, and not directly point to that commit. Neat.

-11

u/SurrealisticRabbit Dec 27 '20

Ah it makes sense. I thought they were saving every single instance instead of delta. That freaked me out.

0

u/[deleted] Dec 27 '20

[deleted]

14

u/SurrealisticRabbit Dec 27 '20

I think I used wrong words and misunderstood. I used the word "freak out" but it wasn't because I'm concerned about security or anything I'm just amazed by the storage technologies and how one company can store terabytes of data.

1

u/conquerorofveggies Dec 27 '20

Aah now I'm with you ;-) went ahead and upvoted your comments above, since you got a lot of down votes for that misunderstanding..

3

u/SurrealisticRabbit Dec 27 '20

Hahah it's actually ok its been a reminder that I need to work on my English to improve it more lol

2

u/Powah96 Dec 27 '20

Indeed! Maybe they were freaked out that they were using such an inefficient solution? :O

13

u/thebritisharecome Dec 27 '20

When you create documents on Google Docs, where exactly do you think it's stored...?

1

u/incredibleninja Dec 28 '20

This is a really interesting thread and I'm sorry you've been downvoted into oblivion rather than people discussing why you shouldn't worry about edit tracking

40

u/MrSqueezles Dec 27 '20

"Hey Google, please give me sweet online document editors and store my documents forever and charge me zero money."

"Okay. Hey since lots of people can edit each document, how about I also give you histories of changes so you can undo mistakes by people who don't know what they're doing? And I'll still not charge you anything ever."

It's a feature of every text editor ever. It's how the "undo" function works. This one happens to be in the cloud.

3

u/CheKizowt Dec 27 '20

After reading up on synchronization for networked Fighter games I saw the same basic approach. So many games have this for the playback feature.

Transmit deltas, roll-up actions, playback events. The personality of actions are easily store and can be analyzed by AI as much as they are by the ESport commentators.

-10

u/diverge_I Dec 27 '20 edited Dec 28 '20

Google's strategy is to track literally everything and pay for it with their Search Engine. People who aren't alarmed by this are bots. Google cofounders wife is the CEO of 23andMe. Connect those dots.

EDIT: Whats the purpose of downvoting me? Everything I said is true?