Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

341–350 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#341

Post by mkl »

lvs wrote: post #295
danpalmer wrote: post #53

As much as we can criticise Google's handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs. I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.…

Edit: I was the one who misread it. My mistake

I think you're the one misreading. From the article: "We do not need to request access to data on https://*/* and http://*/*. Instead, we can simply request data access for https://*.pushbullet.com/*, http://*.pushbullet.com/*, and http://localhost/*."

Re: Let's guess what Google requires in 14 days or they kill our extension

#342

Post by danpalmer »

munk-a wrote: post #330
danpalmer wrote: post #292

Earlier quoted context omitted.

As mentioned, I think Google have handled it poorly, but their fundamental position – that this extension is incorrectly using permissions – was significantly correct and may prove to be fully correct. Google deserve criticism for the lack of clarity in the communication, they deserve criticism for the lack of human touch, customer support and many other aspects. They do not deserve criticism for calling out incorrec…

It's confusing because whatever system (whether human or automated) they're using to flag permission issues has more precise detection abilities than they chose to expose with a simple "Permission is too wide - fix it". The fact that the extension has over broad permission asks isn't good but I think saying their communication lacks clarity is underselling just how opaque they were with their feedback. It also concer…

It's possible that the flagging has come from user submitted reports. In that case if Google trust the reports (and they have enough data about users to know if reports are likely to be genuine) then they don't necessarily need to know any more details.

Alternatively it could be vague to restrict the possibility of bad actors circumventing the letter of the rules without adhering to the spirit of them, or even just protecting themselves from legal repercussions (perceived or real).

Re: Let's guess what Google requires in 14 days or they kill our extension

#343

Post by propogandist »

cpascal wrote: post #150
RcouF1uZ4gsC wrote: post #130

Earlier quoted context omitted.

The most important change you can make for your email is to own your own domain. Once you own your own domain, changing providers is much easier since it is transparent to the people that email you. Even if you decide to keep Gmail, you should switch your email to your own domain.

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.

Re: Let's guess what Google requires in 14 days or they kill our extension

#344

Post by vorpalhex »

mtnGoat wrote: post #336
jtxx wrote: post #64

Earlier quoted context omitted.

ProtonMail has come a long way as a replacement for Gmail as well. Suuuper happy with them, they're really responsive to feature requests and support inquiries. I requested for an iOS feature to choose browsers so I could open all links from PM in Firefox. They had it implemented in a month or something... it a quick fix but that impressed me. hence me shilling here They recently added ProtonCalendar too.

I used protonmail for a week, but i got tired of waiting hours and days for some emails to arrive. some we so late the verification links were no longer active. ugh, if only proton mail was up to par with Gmail.

I had similar issues early on but have been happy with Protonmail for the last year or so.

Re: Let's guess what Google requires in 14 days or they kill our extension

#345

Post by skykooler »

lostcolony wrote: post #317
londons_explore wrote: post #266

Earlier quoted context omitted.

If you keep up to date with commits on the chromium code repo, you'd see them change it from time to time. For a while it was 'youshallnotpass'. You probably shouldn't be using an opensource project without at least a cursory glance at the code anyway, especially as a power user.

You're kidding right? You look at every commit of every open source app you use, or that a closed source app is built atop? For me, off the top of my head, that would mean, yes, Chrome, Firefox, the Linux Kernel, Libre Office, Android, VLC...probably plenty more that I am unaware are open source, and that's not even considering the dev tools to do my job. When would I actually have time to have a life?

Exactly. Reading the source of every program you used was certainly possible back in the 80's when the FOSS movement started; but nowadays, with every program being millions of lines of code, it's implausible to get through all that and still have time to actually use the software.

Re: Let's guess what Google requires in 14 days or they kill our extension

#346

Post by mtnGoat »

I know Google employees that have had their accounts on various Google Services shutdown and they couldn't even get them back themselves. The place is very siloed, something needs to give because these nightmare scenarios keep happening over and over.

Re: Let's guess what Google requires in 14 days or they kill our extension

#347

Post by janee »

Ironic reading this today. Got locked out of an old gsuite we manage for someone on Monday because I typed the recovery mail wrong 3 times...omg what a crazy battle to follow their recovery process.

Sent them sooo much proof, answers, cname changes, invoices, emails, etc etc, but still get the same canned response back.

The weird thing is I never got a single notification on the recovery mail that unauthorized access was attempted and that the account got locked.

Honestly I feel like such a dumb ass for making our company use gsuite now. I don't think I'll ever recommend a google product to anyone again.

Re: Let's guess what Google requires in 14 days or they kill our extension

#348

Post by prox »

colejohnson66 wrote: post #144
kadoban wrote: post #124

Earlier quoted context omitted.

I'd stress the "get your own domain" part. This is a _requirement_, or you're going to be going through the same pain again in a few years. Also, make sure you take backups of your old emails every once in a while. Google Checkout should be able to provide those.

What’s the risk of losing your domain from a forgotten renewal?

I only work with a company who’s team I can actually call. i pay a bit more, but that direct access is great.

It’s actually hard to lose a domain if you have a good registrar. There is 90 day quarantine period even if you cross the renewal treshold. You can also domain lock, which means you need to manually unlock a domain before moving.

Re: Let's guess what Google requires in 14 days or they kill our extension

#349

Post by mythrwy »

nucleardog wrote: post #257
toohotatopic wrote: post #210

Earlier quoted context omitted.

So, which ones are the good registrars?

I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Am…

So use Google or Microsoft to register your domain?

Doesn't that bring us back to the same potential problem though?

Re: Let's guess what Google requires in 14 days or they kill our extension

#350

Post by ztjio »

toohotatopic wrote: post #284
ztjio wrote: post #277

Earlier quoted context omitted.

Google is great for this because they will never actually let anyone talk to a human in order to apply social engineering techniques ;)

But do you lose your domain if google bans your account? The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.

So my statement was a total comedic effort not to be taken seriously, I'd never suggest anyone use a company on the basis of terrible customer support. That's what the semi-colon parentheses at the end was meant to signify.

To attempt to actually answer your question, I believe the nature of the governance around registrars would ensure you have recourse to transfer your domain in the case that Google be Google. It might not be slick. I don't know. But, it's unlikely they can override the overarching policies for such things and continue being a registrar.

Post reply on HN