Google confirms it's letting third parties scan your Gmail
theinquirer.net
theinquirer.net
1. https://www.theinquirer.net/inquirer/news/3035211/gmail-app-...
2. https://news.ycombinator.com/item?id=17446459
(Disclaimer: I work for Alphabet, but having nothing to do with Gmail, except that I'm very sad Inbox is being discontinued.)
1. Chrome extensions can pretty much do whatever they want. These should be used sparingly.
2. OAuth tokens, which is what this post is alluding to. So if you're using an Email client on your laptop or phone there are two models for authentication:
a) Enter your username and password. You really don't have much control over what happens from this point and most people are agreed that this is generally a bad idea; or
b) Create a token that will grant access (and certain permissions) to someone who uses it. In the OAuth model you have two token types: access (short(ish) lived) and refresh (that can generate new access tokens). When a site asks you for OAuth permissions that mention anything about "offline" usage, you're really granting it a refresh token.
An access or refresh token can be revoked.
However once an app has an OAuth token there's not a whole lot stopping a malicious developer in using that token themselves for whatever purpose they like... including scanning your emails and selling that data.
So it's not so much that "Google lets third parties scan your email" as much as it's "Google lets you use third-party apps to access GMail" and the rest follows as "well, that's how computers work". It's not much different to sending someone a photo and then losing any control over its further distribution.
Part of the solution might be informational: make it more clear how dangerous it is to give an extension 'control' of a domain or, as it often the case, all the pages you ever visit.
Or perhaps there are ways to make this more granular: considering that web apps are more and more powerful, limit not just on what domains an extension can operate, but limit what it can do. While I imagine this one is more challenging, if installing an extension says "this extension can READ and MODIFY stuff on <domain>, but will never send this data anywhere" could be a huge win (assuming this is possible to detect automatically).
Finally, depending on how much power an extension has, Google could be more diligent about gatekeeping (assuming they aren't already).
To give an example: I use cVim. It's permissions are: - Read and change all your data on the websites that you visit - Read and change your browsing history on all your signed-in - devices - Read and change your bookmarks - Read and modify data that you copy and paste - Manage your downloads
I understand and accept that it needs to do these things, but it strikes me as rather important whether the plugin is allowed to GET/POST stuff too. Correct me if I'm wrong, but looking at my other plugins, this does not appear to be a specific permission.
I'd basically be happy to allow a plugin access to everything the browser has on me, provided that it can't send this data anywhere.
(and, assuming I'm wrong and this is actually a permission, clearly most of my phoning-home plugins seem to get around it using a somewhat opaque other permission to do this. probably "Read and change all your data on the websites that you visit", which sort of is correct, but shouldn't be)
News flash: Apple mail also can read my gmail, because I configured it to do so!
If you use a 3rd party email app that adds any kind of features to your email, like, say, notifying you that a flight is coming up, then they're scanning your email. It doesn't have to be a gmail account. It could be ANY account you grant the 3rd party access to.
If they do this for free... well, you're the product.
This seems a bit like claiming "Google confirms it lets other users read your email" because the ability to forward (or even copy and paste) exists.
I think the article does a poor job of differentiating the fact that this has little to do with gmail, and everything to do with third-parties that are trying to access your e-mail.
Having an API is hardly something to be reprimanded over.
And, yes, I realize this is pretty much a nothing burger. They lost my trust, though, and any attempts to make me believe that they have stopped and that this won't be a problem in the future are falling on deaf ears here.