Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s painful Gmail OAuth verification process

aura.app

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Google’s painful Gmail OAuth verification process

#11

Post by orion138 »

Alex3917 wrote: post #4
privateSFacct wrote: post #3

As a gmail user - good to hear this. In the long run trust is going to be a much more important commodity that letting a spam app into your gmail. If you look at the service that want access to all your gmail data - many promise something "free" but then mine that data (in the fine print) to send you offers, alert you to "savings" etc. I automatically turn down apps that say they need access to my entire google drive…

> Why not just ask for permissions for a single app specific folder? Basically because Gmail A) doesn't have folders B) doesn't have permissions based on tags. Otherwise most Gmail API apps would have this option. The same thing is a problem when you want to delegate access to an email account, where there should be a way to delegate access based on tags, but there just isn't. What you can now do is create Gmail Add-…

Looks interesting but it’s unclear to me, do you copy the threads content?

One other comment, there seems to be a spammer on the review page...

Re: Google’s painful Gmail OAuth verification process

#12

Post by jacobsenscott »

This terrible, but building a business based on third party api's is always a tremendous risk. This isn't the first time a bunch of small apps have been killed off by some company making their api's inaccessible.

Also, for people who are pushing for more government regulation of service providers - this is the lite version of what you are asking for.

Re: Google’s painful Gmail OAuth verification process

#13

Post by jonbronson »

jacobsenscott wrote: post #12

This terrible, but building a business based on third party api's is always a tremendous risk. This isn't the first time a bunch of small apps have been killed off by some company making their api's inaccessible. Also, for people who are pushing for more government regulation of service providers - this is the lite version of what you are asking for.

> this is the lite version of what you are asking for

I'd say this is the heavy version. A new startup can put together and run a GDPR compliant web app for over a year for far less than $15,000.

Re: Google’s painful Gmail OAuth verification process

#14

Post by tick_tock_tick »

jonbronson wrote: post #13
jacobsenscott wrote: post #12

This terrible, but building a business based on third party api's is always a tremendous risk. This isn't the first time a bunch of small apps have been killed off by some company making their api's inaccessible. Also, for people who are pushing for more government regulation of service providers - this is the lite version of what you are asking for.

> this is the lite version of what you are asking for I'd say this is the heavy version. A new startup can put together and run a GDPR compliant web app for over a year for far less than $15,000.

As long as no requests that you delete their data or provide them with a copy. As soon as that starts happening $15k doesn't go very far in man hours to comply.

Re: Google’s painful Gmail OAuth verification process

#15

Post by Klathmon »

jonbronson wrote: post #6

As both a gmail user and developer interested in applications to help me manage my personal information, this is incredibly depressing to hear. The idea of a verification process itself is great, and I applaud that effort. But some of these barriers seems put in place solely to kill competition and prevent startups from filling the personal data needs before Google comes up with its own plan. These exorbitant fees of…

It's the direction that everyone seems to be moving. Wall up the gardens, remove your own access to your information, and remove the ability to share and integrate across platforms.

The weird thing is how quickly the sentiment turned from my perspective. I felt like one day most technical people applauded the ability to have total real-time access to your data, to be able to write code or use open source code to plug into these systems and augment them for better. To be able to have a startup or small company write software that can work with your google/facebook/apple/whatever account and use the information there in new ways.

Then all of a sudden (I feel like it was between 1-2 years ago, but I can also barely remember what I had for lunch yesterday so don't quote me on that!), technical people started slamming companies for "allowing someone to access their data", I saw lots of headlines about how it was unethical for Facebook to allow users to share their information with other companies (don't get me wrong, facebook does plenty wrong, but to call out the ability to share info specifically seemed so wrong). Then APIs started shutting down, access is now only allowed for other big players, and it's getting harder and harder to integrate outside of a single player's walled garden.

I get why the companies are doing it (someone told them the only ethical thing was to lock users in!?), but I don't get why HN and other technical circles are applauding it. Maybe i'm on the wrong side of history here, but I just feel like it's never a bad thing to allow me to share my information if I want. I think it should be clearly defined what i'm sharing, I think it should be obvious that i'm sharing it, and I think that some auditing and controls are obviously a good thing, but not this almost absolute shutdown of any ability for me to export or use information from these services on my own.

But maybe I'm really in a bubble, and maybe users really shouldn't be given the choice to share their personal information, but it just feels so wrong and so "holier than thou" to make that choice for them.

Re: Google’s painful Gmail OAuth verification process

#16

Post by Alex3917 »

orion138 wrote: post #11
Alex3917 wrote: post #4

Earlier quoted context omitted.

> Why not just ask for permissions for a single app specific folder? Basically because Gmail A) doesn't have folders B) doesn't have permissions based on tags. Otherwise most Gmail API apps would have this option. The same thing is a problem when you want to delegate access to an email account, where there should be a way to delegate access based on tags, but there just isn't. What you can now do is create Gmail Add-…

Looks interesting but it’s unclear to me, do you copy the threads content? One other comment, there seems to be a spammer on the review page...

> do you copy the threads content?

Basically we take each message of the thread, normalize the typography so that it can be consistently styled, and then strip off the signatures and quoted reply text while leaving any quoted inline replies. There are some open source libraries that do parts of this, but none of them worked well enough for this particular use case so we ended up just developing some new techniques ourselves.

The other thing the tech does is it lets people run much more accurate NLP on threads. This isn't fully productized yet, so right now there are just a handful of companies we're working with to clean and normalize their email data.

In terms of the spammer, yeah I see that but I'm not sure what I can really do. As the app creator I don't seem to have any special ability to delete comments or flag things as spam.

Re: Google’s painful Gmail OAuth verification process

#18

Post by jacobsenscott »

jonbronson wrote: post #13
jacobsenscott wrote: post #12

This terrible, but building a business based on third party api's is always a tremendous risk. This isn't the first time a bunch of small apps have been killed off by some company making their api's inaccessible. Also, for people who are pushing for more government regulation of service providers - this is the lite version of what you are asking for.

> this is the lite version of what you are asking for I'd say this is the heavy version. A new startup can put together and run a GDPR compliant web app for over a year for far less than $15,000.

It seems easy because you don't need to prove it. You can do your best and then launch it.

But you can't prove it for under $15k and if you are successful eventually you'll need to prove it.

Anyway, I'm not talking about the GDPR. That's just bureaucrats testing the water. The US congress is starting to look for ways to get their cut as well.

It will get to the point where you need to prove compliance with multiple conflicting regulations first, before launching. Now you need to spend $100,000 on auditors before your first push to heroku.

Most people in software, especially startups, have never had any contact with a regulated industry and don't know what they are in for.

Re: Google’s painful Gmail OAuth verification process

#19

Post by icebraining »

tick_tock_tick wrote: post #14
jonbronson wrote: post #13

Earlier quoted context omitted.

> this is the lite version of what you are asking for I'd say this is the heavy version. A new startup can put together and run a GDPR compliant web app for over a year for far less than $15,000.

As long as no requests that you delete their data or provide them with a copy. As soon as that starts happening $15k doesn't go very far in man hours to comply.

From personal experience, yes, it really does. Why do you think otherwise?

Re: Google’s painful Gmail OAuth verification process

#20

Post by wjossey »

As someone who tried to develop a tool to help pause their box to improve focus throughout the day, I got bit by this process as well.

Basically google just went dark on me altogether. Has been months since their last reply and I kept trying to follow up. The feature I needed elevated permissions on was the ability to add filters, which unfortunately is buried with a bunch of other more dangerous permissions.

Looks like I’ll never get to launch the product :(

On the plus side, it works fine for just me! So, I just built a tool only I can use.

Post reply on HN