Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s painful Gmail OAuth verification process

aura.app

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Google’s painful Gmail OAuth verification process

#31

Post by bengotow »

I'm the author of the Mailspring email client and I've been dealing with this Oauth verification process for the last three months. Mailspring has "pro" features that leverage a small backend API, but it syncs your mail on your computer and your mail data, passwords, tokens, etc. never leave your machine. I care very much about data privacy and I wouldn't use the app myself if it was sending mail data to the cloud.

I'm a big fan of Google watching out for their users. I know of at least one very sketchy company that has shut down because of this new policy, which is great.

But after three months, they basically told me: "Your desktop app makes a network request to a third party server, you must pay $15,000 for a security audit." Their process has been vague and I wish they'd make an effort to understand whether an audit is really necessary. Their security contractors are going to be laughing all the way to the bank as they review my web service that never sees Gmail data in the first place.

Thankfully, Mailspring makes a bit of money and I can afford to do this to keep it alive. But fast-forward a few years and this is going to devastate innovation and development of third party mail clients. (And I think Google prefers it this way.) If the app didn't already have critical mass, or if I was just starting a mail app now, I'd probably throw my hands up and give up rather than emailing them dozens of times and coughing up $15k.

Re: Google’s painful Gmail OAuth verification process

#32

Post by manigandham »

privateSFacct wrote: post #3

As a gmail user - good to hear this. In the long run trust is going to be a much more important commodity that letting a spam app into your gmail. If you look at the service that want access to all your gmail data - many promise something "free" but then mine that data (in the fine print) to send you offers, alert you to "savings" etc. I automatically turn down apps that say they need access to my entire google drive…

>> Why not just ask for permissions for a single app specific folder

That's not possible. Many people and apps have been asking for more fine-grained permissions from Google APIs for years. It hasn't been done other than a few changes on Android.

This is common with most large providers that have big 3rd party ecosystems but very poor permissions that only offer all-or-nothing access.

Re: Google’s painful Gmail OAuth verification process

#33

Post by infamia »

gonyea wrote: post #22

This all makes sense to me. If you're not providing enough value to users to cover the >$15k fee, you're just an attack vector for user data. Consistency of the process aside, I'm really not sure what people would expect. (I work at Google, yadda yadda, but have nothing to do with this.)

Startups and open source projects get screwed because of Google's lack of nuance on this issue. Google could have created a tiered fee structure based on number of users, threat vector, etc. but didn't for whatever reason.

Re: Google’s painful Gmail OAuth verification process

#34

Post by PaulHoule »

joshuamorton wrote: post #30
PaulHoule wrote: post #28

Earlier quoted context omitted.

Sure, IMAP, POP, CALDav, same as all the other mail providers... And the optimized JMAP protocol too. The fact that I am getting voted down proves how absolute the groupthink is... If you work in Google's ecosystem, however, the only possible exit is being bought by Google... Get bought by a competitor and they'll just turn you off.

So the answer is no then, because Gmail still provides imap and pop, which are unaffected by this.

But how does the credential management work?

Re: Google’s painful Gmail OAuth verification process

#35

Post by joshuamorton »

PaulHoule wrote: post #34
joshuamorton wrote: post #30

Earlier quoted context omitted.

So the answer is no then, because Gmail still provides imap and pop, which are unaffected by this.

But how does the credential management work?

I don't recall since the last time I set it up was a while ago, but I think just your password + an app specific code if you use 2fa normally. But yeah I'm pretty confident this doesn't apply to outlook.

Re: Google’s painful Gmail OAuth verification process

#36

Post by praneshp »

privateSFacct wrote: post #3

As a gmail user - good to hear this. In the long run trust is going to be a much more important commodity that letting a spam app into your gmail. If you look at the service that want access to all your gmail data - many promise something "free" but then mine that data (in the fine print) to send you offers, alert you to "savings" etc. I automatically turn down apps that say they need access to my entire google drive…

>> Why not just ask for permissions for a single app specific folder

Dropbox lets apps work on either a single app specific folder, or on your entire dropbox.

But the app has to be one type or the other, the user cannot choose what access they want to give out.

Disclosure: I work at dropbox, previously on the api-platform team.

Re: Google’s painful Gmail OAuth verification process

#37

Post by PaulHoule »

joshuamorton wrote: post #35
PaulHoule wrote: post #34

Earlier quoted context omitted.

But how does the credential management work?

I don't recall since the last time I set it up was a while ago, but I think just your password + an app specific code if you use 2fa normally. But yeah I'm pretty confident this doesn't apply to outlook.

So why don't we see more startups use open protocols for access to email rather than make things that are GMail specific?

Why do you get voted down for just suggesting that they do so?

Re: Google’s painful Gmail OAuth verification process

#38

Post by gonyea »

infamia wrote: post #33
gonyea wrote: post #22

This all makes sense to me. If you're not providing enough value to users to cover the >$15k fee, you're just an attack vector for user data. Consistency of the process aside, I'm really not sure what people would expect. (I work at Google, yadda yadda, but have nothing to do with this.)

Startups and open source projects get screwed because of Google's lack of nuance on this issue. Google could have created a tiered fee structure based on number of users, threat vector, etc. but didn't for whatever reason.

Goal #1: Don't let the users "get screwed."

Goal #2: Don't have a solution that requires an army of people to manage.

If no one's willing to help fund your idea, you're out of luck. That seems... really understandable, given that every major government is literally investing millions trying to hack into Google's user data.

Re: Google’s painful Gmail OAuth verification process

#39

Post by pmlnr »

PaulHoule wrote: post #2

To the contrary it will be very good for innovation because it means people will build extensions for other email providers such as Fastmail.

No. If you want, build an email app with features or with it's own plugins. Not extensions around closed, single point of failure services.
Post reply on HN