Google Drive for Desktop Flaws

Putting this out there anyway, whether anyone will see this post is another thing. This is a tiny site 🙂

The number one flaw of Google Drive for Desktops when using G Suite (so in a business environment) is the lack of auditing. It states this on their support page.

  • Downloads from the following sources are not logged:
    Google Drive for Mac/PC sync client downloads

This essentially means someone in your organisation can upload loads of documents to their Google drive making sure they keep them as Office documents or other types (just not G Suite file types). They then install Google Drive for Desktop on their personal PC/Mac and connect their work account. This will then sync all their files to their personal desktop with no auditing. They can then copy all these files from their Drive share to elsewhere on their PC/Mac. They’ve now stolen lots of your data with no audit trace.

If you natively just use G Suites docs, this becomes harder for them to do, because they first need to download all the documents from a browser which automatically will convert them to Office. This means if they then try to open the Office docs, they can. If they leave them as G Suite documents they won’t be able to view them. This is because they will open in a browser and they will need to login with their work account to view them.

Worst still, if the person has left and their account disable. When they disconnect their work account on their personal PC/Mac, it doesn’t then wipe the files already sync to their Google Drive folder on the desktop. It keeps them available for them to actively copy or read.

I see that as a large flaw but then I’m no security expert, I just have an interest in it.