Hacker News Reader

Wow, that's nuts. My gmail account is the gateway to password resetting a bunch of different accounts, not to mention all the private correspondences. It would have to be quite the value proposition to make me give up the keys. And these idiots give it away for nothing at all?

View on HN

Yes. We had numerous SSN and bank account details, basically anything you might find in a personal or professional email inbox. Obviously we weren't making use of any of this, but if we had one malicious engineer, things could have gone very poorly. One automated tool inadvertently posted an individual's SSN on the paid version of our site was very angry. The level of access was something we were always discouraged from discussing with sales folks and management always kept things very vague.

Holy... Okay, just went to https://security.google.com/settings/security/permissions and revoked permissions for a bunch of apps. Thanks for this story.

Can you actually give that kind of gmail access to third party apps? Luckily I don't but it's unnerving to think that doing so can have those ramifications.

Reply on news.ycombinator.com