Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wmail – Desktop client for Gmail and Google Inbox

thomas101.github.io

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Wmail – Desktop client for Gmail and Google Inbox

#41

Post by songgao »

AntiRush wrote: post #35
songgao wrote: post #29

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app: WMail.app/Contents/Resources/app/bin/shared/credentials.js , and this seems to be used in authentication with Google: https://github.com/Thomas101/wmail/blob/master/src/main/Auth...

I think "secret" is a misnomer here. The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.) https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")

Interesting. Thanks for the link! I wonder why they still require a client_secret in installed application?

Re: Wmail – Desktop client for Gmail and Google Inbox

#42

Post by [deleted] »

darren wrote: post #20

I've used Mailplane for years - http://mailplaneapp.com Yes, it is "just" a wrapper, but it's nice having Mail and Calendar in a separate dedicated app. I can restart my browser without impacting my mail, and the integration with the desktop (e.g. mailto: links just work, I can use quicklook on attachments, better drag and drop support, etc.) make it worthwhile.

[deleted]

Re: Wmail – Desktop client for Gmail and Google Inbox

#43

Post by THRWAWA20160222 »

gravypod wrote: post #40
THRWAWA20160222 wrote: post #34

Earlier quoted context omitted.

A few years ago - http://techcrunch.com/2012/07/06/so-thats-it-for-thunderbird... http://forums.mozillazine.org/viewtopic.php?f=39&t=2499053&s...

From what I am reading it is being maintained. Is this the case or am I incorrect?

You are right! TIL Thunderbird is still being maintained!

Re: Wmail – Desktop client for Gmail and Google Inbox

#44

Post by brbsix »

bikamonki wrote: post #27

Speaking of it, can Google deny access to one's email from a non-google client?

Many people use third-party email clients via POP, IMAP, or an application-specific password. Just think about all the people using Thunderbird, mobile email clients, etc. The day they stop permitting that is the day they no longer offer an email service.

Re: Wmail – Desktop client for Gmail and Google Inbox

#47

Post by gravypod »

THRWAWA20160222 wrote: post #43
gravypod wrote: post #40

Earlier quoted context omitted.

From what I am reading it is being maintained. Is this the case or am I incorrect?

You are right! TIL Thunderbird is still being maintained!

Yep, but on another note if you don't need all of the features of thunder bird and you are looking for something self hosted check out http://www.rainloop.net/

Re: Wmail – Desktop client for Gmail and Google Inbox

#48

Post by AndrewGaspar »

songgao wrote: post #29

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app: WMail.app/Contents/Resources/app/bin/shared/credentials.js , and this seems to be used in authentication with Google: https://github.com/Thomas101/wmail/blob/master/src/main/Auth...

There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getting any additional security because Wmail still needs to store some sort of credential on your machine for persistent login that an attacker could steal to authenticate with Wmail on their own machine.

An attacker would have to steal your access token stored locally on your machine to use with this public client id and client secret, and if you have software that's maliciously scraping credentials from your machine you already have a problem.

Post reply on HN