Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oauth2 support for GMail

pmail.com

Post reply on HN
Print view View original

51–60 of 136 posts

Re: Oauth2 support for GMail

#51

Post by undecisive »

Fizzadar wrote: post #25

I’ve gone through this process for my email client Kanmail [1]. The third party audit is not required for email clients that run on end users computers and store credentials locally. By the looks of it Pegasus falls into this category and should not have any issues getting approved (still need the YT video and such but the Google team are surprisingly responsive and helpful in my experience). [1] https://kanmail.io

The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment.

Do you have evidence - in writing - to the contrary from a Google official?

Abridged wording and my non-lawyer interpretation below in case I'm not clear:

> Every app that [accesses Gmail and also accesses other servers] is required to go through a security assessment from Google empanelled security assessors. [...]

> In order to maintain access to restricted scopes, the app will need to undergo this security assessment on an annual basis, [... costs usually] between $10,000 - $75,000 (or more) [...]

> This fee may be required whether or not your app passes the assessment and will be payable by the developer."

Re: Oauth2 support for GMail

#53

Post by vivekv »

qwerty456127 wrote: post #20

I have one question in this regard: will I still be able to access my mail through my own script I myself wrote? I understand I will probably have to make some changes and click some things in GMail settings but is this still going to be possible or will I too have to "publish app" even if I only mean it for my own private usage?

For now app passwords

Re: Oauth2 support for GMail

#57

Post by VTimofeenko »

mbwgh wrote: post #10

I had a similar brick wall moment after having written a tool to sync Google Calendar events with the `when` calendar tool ( http://www.lightandmatter.com/when/when.html ). Which is why I never published it (although I have been using it for almost two years), and setting it up requires a series of laborious steps of activating the Google Developer Console, creating API keys etc., which I found just to embarrassing t…

I don't think it would be embarassing. Other tools use the same approach, like rclone:

https://rclone.org/drive/

Re: Oauth2 support for GMail

#58

Post by irishsultan »

corentin88 wrote: post #45
jtbayly wrote: post #36

Earlier quoted context omitted.

If you want to create a video, you’re one of the 17 developers in the world that does. Your criticism was completely unnecessary. It doesn’t say anything about the Pegasus dev except that he’s normal.

You _have_ to create a video. That’s a requirement. You don’t event have to talk or show your face on it though. I agree many people doesn’t like to record videos, I’m one of them, but you are a developer and your app is going to be available to 1.5 billion users of Gmail. Complaining about having to record a video (which is what Pegasus dev did) is not _normal_.

> You _have_ to create a video. That’s a requirement.

How is that in any way related to your comment that he shouldn't complain about it? If it wasn't a requirement then there would be no reason to complain in the first place.

And that's not even what his main complaint, his main complaint is that he shouldn't have had to record the video in the first place because the warning about this feature costing money should have been documented somewhere together with all other requirements.

Basically Google is behaving like that website that tells you "your password should be more than 8 characters", change password submit, "your password should be less than 16 chararcters", change password submit, "should contain at least one upper character", change password submit, "should contain a special character", change password submit, "should not contain single quotes or other characters that are too special", repeat ad nauseam. If you have requirements document them up-front and all in one place.

Re: Oauth2 support for GMail

#59

Post by kenmacd »

corentin88 wrote: post #28

I believe many comments here will criticize Google. But objectively, Google is at its best here: - in terms of privacy, applications that have access to your Gmail inbox now require a security audit. - the audit is not required for MVP ( Of course, you have to pay for the audit. But: - it’s only required when you ask for restricted user data (i.e. reading my emails). - Google doesn’t take 30% of your revenue to use i…

My issue with this is that to access my own email I get countless warnings, and always have a 'You have recommended actions' Security Checkup for 'Remove risky access to your data'.

This is after jumping through a bunch of hoops to create a GCP app. It even complains about the pseudo-app being from an 'Unverified developer' despite that developer being me.

Re: Oauth2 support for GMail

#60

Post by dal »

undecisive wrote: post #51
Fizzadar wrote: post #25

I’ve gone through this process for my email client Kanmail [1]. The third party audit is not required for email clients that run on end users computers and store credentials locally. By the looks of it Pegasus falls into this category and should not have any issues getting approved (still need the YT video and such but the Google team are surprisingly responsive and helpful in my experience). [1] https://kanmail.io

The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment. Do you have evidence - in writing - to the contrary from a Google official? Abridged wording and my non-lawyer interpretation below in case I'm not clear:…

So basically when your application resolves gmail.com you will access other servers. :P
Post reply on HN