4 ms·

This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number. I r

This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number. I remember when the big wave of smart email apps first came out a few years ago, and the horror was the expressed here when it was revealed that these apps basically route all of your email through their servers in order to do processing on it. Sadly at lot of the trepidation about services like that seems to have abated -- or maybe the general population just isn't aware of how intrusive these types of services could be. But I would never allow any third party service to access my email.

nialo 9y ago
I think this is correct but maybe not quite far enough. I am much more willing to give out my social security number than my Gmail password.
jerf 9y ago
"This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number." Have you ever emailed your social security number, had your social security number emailed to you, or signed up for any sort of service to your gmail account including your paycheck management company, your tax returns, your bank, or anything else that via email password reset could be used to access your social security number? Certainly I'd go so far as to say that almost anybody's "real" gmail account could certainly be leveraged to get the last four digits of your social security number. Given the low entropy of the other 5 numbers given other details [1], even if you can say with a straight face that your email has never had your very, very regex-able social security number in it, it's still got most of the bits, most likely. Perhaps not enough to automatically target you without a bit more machine learning than I think we quite have at the moment, but... getting perilously close, honestly. Someone who really dedicated themselves to taking "gmail inboxes" and writing a system to determine social security numbers from that could probably do pretty well. It wouldn't quite be just "fire some machine learning at it", but the system as a whole seems pretty feasible to me. [1]: http://www.stevemorse.org/ssn/ssn.html http://www.stevemorse.org/ssn/ssn.html . It isn't quite as bad as it seems for many of us, because we didn't all used to get SS numbers at birth, so my SS number does not correspond to my birth. But if you have my last 4 numbers and a handful of other bits of information about where I've lived, it's distressingly few bits between me and my identity getting stolen.
- jonheller 9y ago
  Oh, I would not be surprised if my SSN is floating somewhere out there because of something like this. So that's a good point. I was more making the comparison because I was looking for an analogy to something most people at least try to guard heavily.
- mtanski 9y ago
  A common way to get SSN in your email is either lease or mortgage documentation. Esp, if they send you results of any of these documents via email.
Kiro 9y ago
> akin to asking for my social security number In many countries this is public information. Why is it sacred in the US? What can you do with it?
- actsasbuffoon 9y ago
  I could try to explain, but this video does a better job than I could hope to: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus

nialo 9y ago

I think this is correct but maybe not quite far enough. I am much more willing to give out my social security number than my Gmail password.

jerf 9y ago

"This may sound silly, but I consider any application that requests full read access to my Gmail account to be akin to asking for my social security number." Have you ever emailed your social security number, had your social security number emailed to you, or signed up for any sort of service to your gmail account including your paycheck management company, your tax returns, your bank, or anything else that via email password reset could be used to access your social security number? Certainly I'd go so far as to say that almost anybody's "real" gmail account could certainly be leveraged to get the last four digits of your social security number. Given the low entropy of the other 5 numbers given other details [1], even if you can say with a straight face that your email has never had your very, very regex-able social security number in it, it's still got most of the bits, most likely. Perhaps not enough to automatically target you without a bit more machine learning than I think we quite have at the moment, but... getting perilously close, honestly. Someone who really dedicated themselves to taking "gmail inboxes" and writing a system to determine social security numbers from that could probably do pretty well. It wouldn't quite be just "fire some machine learning at it", but the system as a whole seems pretty feasible to me. [1]: http://www.stevemorse.org/ssn/ssn.html http://www.stevemorse.org/ssn/ssn.html . It isn't quite as bad as it seems for many of us, because we didn't all used to get SS numbers at birth, so my SS number does not correspond to my birth. But if you have my last 4 numbers and a handful of other bits of information about where I've lived, it's distressingly few bits between me and my identity getting stolen.

jonheller 9y ago
Oh, I would not be surprised if my SSN is floating somewhere out there because of something like this. So that's a good point. I was more making the comparison because I was looking for an analogy to something most people at least try to guard heavily.
mtanski 9y ago
A common way to get SSN in your email is either lease or mortgage documentation. Esp, if they send you results of any of these documents via email.

Kiro 9y ago

> akin to asking for my social security number In many countries this is public information. Why is it sacred in the US? What can you do with it?

actsasbuffoon 9y ago
I could try to explain, but this video does a better job than I could hope to: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus