⬇ Download holy card: ·
Blessed DeleFriend, False Friend of Delegation
Patron of domain-wide delegation in Google Workspace, service accounts, and everyone who grants trust once and for all.
Life
On 28 November 2023 Hunters researchers described DeleFriend, a design flaw in Google Workspace's domain-wide delegation. Whoever controlled a service account could try many combinations of keys and scopes to discover which delegations were active, and abuse them to impersonate the domain's users and reach Gmail, Drive and the other services. Delegation, meant as a convenience, became a shortcut to the entire Workspace.
Prayer
O Blessed DeleFriend, friend who impersonates everyone in delegation's name, let our delegations be few, precise and watched. Amen.
How to celebrate
Celebrated by reviewing domain-wide delegations, limiting the granted scopes and auditing the service-account keys.
Delegation granted lightly is everyone's friend.