Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oauth2 support for GMail

pmail.com

Post reply on HN
Print view View original

91–100 of 136 posts

Re: Oauth2 support for GMail

#91

Post by paxys »

superkuh wrote: post #69

Note that this "OAuth2" support is only for gmail. OAuth 2 is not really an open protocol like OAuth (1) was. It's just something the megacorps shoved down the IETF's throat and every implementation is different enough to need different software. OAuth2 is not good for the health of the internet and will lead to even more lock in. When Google disables imap at the end of the month for gmail (only allowing OAuth2+imap,…

I have no idea what you are talking about. Every Google service (not just GMail), and every major service provider on the internet, uses OAuth 2 as the standard for authorizing API access.

Re: Oauth2 support for GMail

#92

Post by paxys »

Why can't I just enter my own Google client ID/secret on the app and auth against that? There's no approval from Google needed in that case, since I'm not publishing it anywhere.

Re: Oauth2 support for GMail

#93

Post by r00fus »

mawise wrote: post #76
tut-urut-utut wrote: post #49

Earlier quoted context omitted.

If you own your mail domain, it's the time to move off from Gmail. If not, make a clear cut, purchase domain, and never ever be at the mercy of mail provider.

This is so hard. I bought a domain and even started paying for (non-google) email on it over a year ago. But I can't bring my self to start the painful process of migrating everything.

What it'll take is likely a cost/benefit for keeping your non-gmail-website workflow (and taking the leap to jump off gmail) vs. complying and using their (mostly usable) webmail site.

They likely figure most will choose option#2 since it's so painful/expensive to do #1.

Re: Oauth2 support for GMail

#94

Post by Alex3917 »

easton wrote: post #11
solar-ice wrote: post #3

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

I’m super confused about this too, there’s tons of open source apps that use Sign in with Google. Shoot, I’ve used the SDK myself in little apps and never saw this.

"Sign in with Google" is just a button that apps are required to use when they allow the user to interact with Google in some capacity, but don't have their own account management system. Most apps with that button don't have the ability to get any data from Google other than your name and email address though; for apps where you are granting OAuth access to your Gmail, it is very obvious that you are doing so, so it's not likely that you have done it accidentally in the past. (Although you can obviously check on myaccount.google.com)

Re: Oauth2 support for GMail

#95

Post by userbinator »

Moves like this from Big Tech deeply disturb me. I wonder how long it will be until everything you do with them will require their approval. We're already seeing this in the form of "supported browsers" (i.e. Chrome) and their efforts at painting everything else as "less secure" or "insecure". It's time we started pushing more for freedom over "security", before things become even more dystopian...

Re: Oauth2 support for GMail

#96

Post by masukomi »

this implies you won't be able to use Firefox, or Safari, to access Gmail unelss they're willing to fork over their source code and pay the $$$ because all of those are

>...[an] app that requests access to restricted scope Google user´s data and has the ability to access data from or through a third party server

Re: Oauth2 support for GMail

#97

Post by NavinF »

malinens wrote: post #86

There is only one thing why this is done: to make impossible to move from gmail (also with custom domains) to another provider. We have the same problem. We spent hundreds of hours implementing their legacy auth (less secure apps), gmail oauth2 and domain-wide delegation to be later stuck in approval process. Until our app is not approved users can not use e-mail import/migration tool to our inbox.eu service. And the…

Eh why not ask users to upload their takeout files and forward their incoming mail to the new address? https://takeout.google.com/

Read only access to the user’s inbox is enough to reset every password so I’m unsurprised that they make this hard.

Re: Oauth2 support for GMail

#98

Post by userbinator »

onphonenow wrote: post #79
undecisive wrote: post #51

Earlier quoted context omitted.

The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment. Do you have evidence - in writing - to the contrary from a Google official? Abridged wording and my non-lawyer interpretation below in case I'm not clear:…

Google SHOULD NOT promise anything else. This is critical for users security. Yes, developers and business claim they make user data, privacy and security a top priority. As we have seen from plenty of developers on the facebook platform, if not checked, they far to often lie, betray users trust or are just totally incompetent. At least on the business side, giving restricted scopes access (ie, enabling a third party…

Google is also one to "betray users trust"!

Re: Oauth2 support for GMail

#99

Post by w3ll_w3ll_w3ll »

Alex3917 wrote: post #90
tptacek wrote: post #87

Earlier quoted context omitted.

This isn't true at all. The reason Google does this is that there is a huge ecosystem of random apps that request full access to people's mail accounts, which are the most sensitive accounts on the entire Internet , and many of those apps were hot garbage that generated a huge account takeover problem. It's perfectly fair to not like the policy (I don't like some things about it), but it's not reasonable to caricatur…

> many of those apps were hot garbage that generated a huge account takeover problem Are there any publicly known examples of this? I'm not doubting that it's happened, I've just never actually heard about any cases of this with respect to the Gmail OAuth API specifically.

Searching "gmail oauth malicious"

https://duo.com/blog/gmail-oauth-phishing-goes-viral

Re: Oauth2 support for GMail

#100

Post by antisthenes »

Fizzadar wrote: post #25

I’ve gone through this process for my email client Kanmail [1]. The third party audit is not required for email clients that run on end users computers and store credentials locally. By the looks of it Pegasus falls into this category and should not have any issues getting approved (still need the YT video and such but the Google team are surprisingly responsive and helpful in my experience). [1] https://kanmail.io

Your client seems interesting

Is there any reason it can't work on Windows 7?

Post reply on HN