Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oauth2 support for GMail

pmail.com

Post reply on HN
Print view View original

11–20 of 136 posts

Re: Oauth2 support for GMail

#11

Post by easton »

solar-ice wrote: post #3

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

I’m super confused about this too, there’s tons of open source apps that use Sign in with Google. Shoot, I’ve used the SDK myself in little apps and never saw this.

Re: Oauth2 support for GMail

#13

Post by baisq »

rob74 wrote: post #8
acatton wrote: post #5

I'm confused… Why do they want to support the OAUTH flow when they can just the normal app password flow without any change in their code, just documentation for their users. https://support.google.com/accounts/answer/185833?hl=en

Maybe because the first line on the page you linked reads: > Tip: App Passwords aren’t recommended and are unnecessary in most cases. To help keep your account secure, use "Sign in with Google" to connect apps to your Google Account. So, for Google, App Passwords are clearly "second class citizens", deemed insecure and not recommended. And, as an app developer, you probably don't want to be seen as recommending an in…

I assume that users of Pegasus Mail are advanced enough to know that that is bullshit.

Re: Oauth2 support for GMail

#14

Post by rjzzleep »

easton wrote: post #11
solar-ice wrote: post #3

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

I’m super confused about this too, there’s tons of open source apps that use Sign in with Google. Shoot, I’ve used the SDK myself in little apps and never saw this.

The SDK on android or ios you mean? Cause that would be vastly different from adding a web authentication flow such as oauth to a legacy application.

Re: Oauth2 support for GMail

#15

Post by snthd »

solar-ice wrote: post #3

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

Most mail clients can connect to both a google email account and a "third party server" email account.

It's easier to rule out undetectable-by-google data exfilteration if the app can only connect to Google.

The obvious way around this is to make a Google-only edition.

Yuck.

Re: Oauth2 support for GMail

#16

Post by tssva »

jaapz wrote: post #7
pagutierrezn wrote: post #2

misunderstanding? https://twitter.com/wilbowma/status/1526697254140071936?t=45...

I don't think the problem here is that users can still use app passwords instead of OAuth2 - it's that the developer went through the trouble of developing a OAuth2 implementation, went through the necessary laborious steps to submit the application and then was faced with this message: > The cost of the assessment typically varies between $10,000 -$75,000 (or more) depending on the size and complexity of the applica…

The Google documentation regarding Oauth access to Google APIs including Gmail explicitly mentions this requirement. It should not have been a shock to the author. Also this requirement only applies if the app is intended to store the data on a server. An email client which directly accesses and locally stores the email would not require a security audit. Pegasus would not be the 1st email client to use OAuth2 with Gmail and others have not required an audit. Some of the newer email client services which implement advance features by downloading email directly from Gmail to their own servers on the backend to do processing of the email would require a security audit.

Re: Oauth2 support for GMail

#17

Post by kevincox »

acatton wrote: post #5

I'm confused… Why do they want to support the OAUTH flow when they can just the normal app password flow without any change in their code, just documentation for their users. https://support.google.com/accounts/answer/185833?hl=en

The OAuth flow is better. It is easier for users and supports many more methods of authentication.

Really the biggest downside about the OAuth flow is that it requires a relationship with Google (a client key). If this could be a fully decentralized standard it would be fantastic.

Re: Oauth2 support for GMail

#19

Post by solar-ice »

snthd wrote: post #15
solar-ice wrote: post #3

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

Most mail clients can connect to both a google email account and a "third party server" email account. It's easier to rule out undetectable-by-google data exfilteration if the app can only connect to Google. The obvious way around this is to make a Google-only edition. Yuck.

I don't think that's what Google are saying here. I think the sentence is referring to Google user data; as long as the Google user data or credentials to access it does not touch another server, the entire thing does not apply.

In fact, in Google's guidance on this subject, they say:

> Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement [to get a Letter of Assessment].

And in another FAQ:

> Local Data Storage: Local client applications don't need to undergo a security assessment because data is run, stored, and processed only on the user's device. Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement.

My feeling is that the author of Pegasus Mail has checked a checkbox incorrectly somewhere, or alternatively has not implemented the desktop oauth2 flow correctly.

Re: Oauth2 support for GMail

#20

Post by qwerty456127 »

I have one question in this regard: will I still be able to access my mail through my own script I myself wrote? I understand I will probably have to make some changes and click some things in GMail settings but is this still going to be possible or will I too have to "publish app" even if I only mean it for my own private usage?
Post reply on HN