5 ms·

As someone with a startup that heavily leverages Gmail OAuth, this kind of thing is upsetting because it causes folks to lose trust in the technology. Google is

As someone with a startup that heavily leverages Gmail OAuth, this kind of thing is upsetting because it causes folks to lose trust in the technology. Google is partly at fault here though. There should be an audit trail visible to users so that they can see every time a third-party service downloads a message or an attachment. There should also be more granular scopes so that folks can, for example, authorize access to only email threads with certain labels, including the built-in labels. (E.g. only personal email or only commercial email.) It would also be nice if there were a way for folks with the gmail ID of a thread to download the parsed thread/attachments from Google, with a special scope designed for this. (So that services can get the entire DKIM-validated thread by just letting users copy an address, forward the last message, or via a plugin.) I spent over a week writing our TOS, privacy policy, and security page, but privacy laws and the underlying technology should be sane enough by default that people shouldn't need to feel like they need to closely parse every word before signing up.

stuart78 10y ago
Totally agree with the audit trail. From time to time I look at which accounts are connected and nuke most, but making this a better informed decision through access history would be great.
jacquesm 10y ago
An audit trail like that should include every access that Google makes to your email for their own purposes.
- Buge 10y ago
  Human accesses or machine accesses? Because there are constant machine accesses for search indexing and spam detection.
  - jacquesm 10y ago
    Hence the 'for their own purposes'. So not related to gmail.
xur17 10y ago
The ability to restrict access to specific domains would be really helpful for a lot of use cases. For example, there are several travel apps that watch for flight and hotel emails, and then track them / notify you about them. If I could give the app permission to access emails from delta.com, united.com, southwest.com, and aa.com, I would be a lot more comfortable granting access. As it is now, I have to give the app read AND write access to ALL email.
- lurker456 10y ago
  There is a workaround for that. You can create a second account and create a forwarding rule on the first to forward only mails from delta.com, aa.com
  - Alex3917 10y ago
    That only works for individual email messages though, not for threads. So in this case it would work, but it's not a great generalized solution, even by hacky workaround standards.

stuart78 10y ago

Totally agree with the audit trail. From time to time I look at which accounts are connected and nuke most, but making this a better informed decision through access history would be great.

jacquesm 10y ago

An audit trail like that should include every access that Google makes to your email for their own purposes.

Buge 10y ago
Human accesses or machine accesses? Because there are constant machine accesses for search indexing and spam detection.
- jacquesm 10y ago
  Hence the 'for their own purposes'. So not related to gmail.

xur17 10y ago

The ability to restrict access to specific domains would be really helpful for a lot of use cases. For example, there are several travel apps that watch for flight and hotel emails, and then track them / notify you about them. If I could give the app permission to access emails from delta.com, united.com, southwest.com, and aa.com, I would be a lot more comfortable granting access. As it is now, I have to give the app read AND write access to ALL email.

lurker456 10y ago
There is a workaround for that. You can create a second account and create a forwarding rule on the first to forward only mails from delta.com, aa.com
- Alex3917 10y ago
  That only works for individual email messages though, not for threads. So in this case it would work, but it's not a great generalized solution, even by hacky workaround standards.