Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oauth2 support for GMail

pmail.com

Post reply on HN
Print view View original

101–110 of 136 posts

Re: Oauth2 support for GMail

#101

Post by Alex3917 »

tatoalo wrote: post #4

> [...] including even having to prepare a Youtube video showing my code in action. What?!

The video isn't really that hard. You just make a screencast of yourself downloading email while saying "now I'm using the download email scope", and then sending email while saying "now I'm using the send email scope."

They don't care if the videos are terrible quality, it's only for them to understand what they're approving, and to have some documentation if a developer later changes an app to do something nefarious.

Re: Oauth2 support for GMail

#102

Post by Alex3917 »

corentin88 wrote: post #28

I believe many comments here will criticize Google. But objectively, Google is at its best here: - in terms of privacy, applications that have access to your Gmail inbox now require a security audit. - the audit is not required for MVP ( Of course, you have to pay for the audit. But: - it’s only required when you ask for restricted user data (i.e. reading my emails). - Google doesn’t take 30% of your revenue to use i…

> the audit is not required for MVP (100 lifetime signups isn't anywhere near enough to know whether or not an app is commercially viable. If the cap were something like 10,000, or even 2,500, then there would be a lot less complaints.

Re: Oauth2 support for GMail

#103

Post by awinter-py »

> 'Publishing the app' in Google terms requires a quite astonishing number of steps

this is my main gripe with oauth for login -- the amount of overhead for getting it working is absurd. it's not private (goog knows which users use which sites) and there's too much preapproval (company consuming oauth has to have a dedicated google project for each login system)

better, simpler system would be 1) client site issues random token, 2) user forwards token to google, 3) google signs bundle with user's email address + client token, 4) client site verifies bundle with goog's public key

all communication should be through the client, the three way handshake is absurd and some legit sites don't implement the standard correctly

oauth for access federation maybe should require more setup but idk -- I feel like we haven't thought through access federation as a society

Re: Oauth2 support for GMail

#104

Post by relaxatorium »

I'm sympathetic to the extremely legitimate security concerns here, but it's pretty rich for the "open, we're so open" company to be running a classic 90s Microsoft Embrace Extend Extinguish playbook on SMTP/IMAP which, for all its faults, is one of the more important open protocols undergirding the internet.

Re: Oauth2 support for GMail

#105

Post by pferde »

Fizzadar wrote: post #84
undecisive wrote: post #51

Earlier quoted context omitted.

The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment. Do you have evidence - in writing - to the contrary from a Google official? Abridged wording and my non-lawyer interpretation below in case I'm not clear:…

Not sure where this is from but there's a critical part of the quote missing here: > Every app that requests access to restricted scope Google user’s data and has the ability to access data from or through a third party server is required to go through a security assessment An email client that only transmits data to/from Google's own IMAP/SMTP servers does not have the ability to access data through any third party…

What about e-mail clients which allow you to configure multiple accounts at different e-mail providers? Those will be able to access your Gmail data, and also "data from or through third-party servers" in form of receiving or sending e-mail via different mail servers.

Re: Oauth2 support for GMail

#107

Post by hackmiester »

mawise wrote: post #76
tut-urut-utut wrote: post #49

Earlier quoted context omitted.

If you own your mail domain, it's the time to move off from Gmail. If not, make a clear cut, purchase domain, and never ever be at the mercy of mail provider.

This is so hard. I bought a domain and even started paying for (non-google) email on it over a year ago. But I can't bring my self to start the painful process of migrating everything.

At least you will only have to do it once. I migrated from G Suite to Fastmail, but because I had a custom domain, it was basically entirely painless.

Re: Oauth2 support for GMail

#108

Post by hackmiester »

enriquto wrote: post #38
Tepix wrote: post #9

Once again, i'm glad not to be using GMail.

Yep. All these anti-google complaints sound so useless. What did they expect? These issues are always an entirely self-inflicted problem. Google's terms of service are public, clear, and completely unacceptable. Why people keep using their services is beyond me.

It seemed like a good idea in 2005, and switching costs. But yeah, I bit the bullet and left this year.

Re: Oauth2 support for GMail

#109

Post by tiernano »

pferde wrote: post #105
Fizzadar wrote: post #84

Earlier quoted context omitted.

Not sure where this is from but there's a critical part of the quote missing here: > Every app that requests access to restricted scope Google user’s data and has the ability to access data from or through a third party server is required to go through a security assessment An email client that only transmits data to/from Google's own IMAP/SMTP servers does not have the ability to access data through any third party…

What about e-mail clients which allow you to configure multiple accounts at different e-mail providers? Those will be able to access your Gmail data, and also "data from or through third-party servers" in form of receiving or sending e-mail via different mail servers.

Is it not "proxy" like servers they are talking about? You login and the details are stored on a server which does push notifications and the like... instead of your phone polling or pulling email all the time, the proxy server sends a push to the app to update when new mail arrives... is this what they mean?

Re: Oauth2 support for GMail

#110

Post by ForHackernews »

onphonenow wrote: post #79
undecisive wrote: post #51

Earlier quoted context omitted.

The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment. Do you have evidence - in writing - to the contrary from a Google official? Abridged wording and my non-lawyer interpretation below in case I'm not clear:…

Google SHOULD NOT promise anything else. This is critical for users security. Yes, developers and business claim they make user data, privacy and security a top priority. As we have seen from plenty of developers on the facebook platform, if not checked, they far to often lie, betray users trust or are just totally incompetent. At least on the business side, giving restricted scopes access (ie, enabling a third party…

Yeah, imagine if users didn't have benevolent Google protecting them, some unscrupulous company full of unethical developers might scan all their personal email, or monitor what websites they visit, or even collect biometric data and then track their every waking movement in the real world.
Post reply on HN