 onclick = (e) ->
   e.preventDefault()
   address = e.currentTarget.getAttribute 'href'
+
   patt = new RegExp("^(https?[:][/][/]www[.]google[.](com|[a-z][a-z])[/]url[?]q[=])([^&]+)(&.+)*")
   if patt.test(address)
     address = address.replace(patt, '$3')
     address = unescape(address)
-  shell.openExternal fixlink(address)
+
+  finalUrl = fixlink(address)
+
+  # Google apis give us an url that is only valid for the current logged user.
+  # We can't open this url in the external browser because it may not be authenticated
+  # or may be authenticated differently (another user or multiple users).
+  # In this case we try to open the url ourselves until we get redirected to the final url
+  # of the image/video.
+  # The finalURL will be cdn-hosted, static and does not require authentication
+  # so we can finally open it in the external browser :(
+
+  xhr = new XMLHttpRequest
+
+  xhr.onreadystatechange = (e) ->
+    return if e.target.status is 0
+    return if xhr.readyState isnt 4
+    finalUrl = xhr.responseURL
+    shell.openExternal(finalUrl)
+    xhr.abort()
+
+  xhr.open("get", finalUrl)
+  xhr.send()
 
 # helper method to group events in time/user bunches
 groupEvents = (es, entity) ->

        return if not data
        {href, thumb} = data
    else if att?[0]?.embed_item?.type
        data = extractProtobufStyle(att)
        return if not data
        {href, thumb} = data

    updated 'conv'

extractProtobufStyle = (att) ->
    href = null
    thumb = null

    embed_item = att?[0]?.embed_item
    {plus_photo, data, type_} = embed_item ? {}
    if plus_photo?
        href  = plus_photo.data?.url
        thumb = plus_photo.data?.thumbnail?.image_url
        href  = plus_photo.data?.thumbnail?.url
        isVideo = plus_photo.data?.media_type isnt 'MEDIA_TYPE_PHOTO'
        return {href, thumb}

    t = type_?[0]
    return console.warn 'ignoring (old) attachment type', att unless t == 249
    k = Object.keys(data)?[0]
