5 ms·

> This is a perfectly valid security guard that protects their users No it's not. It's Google telling it's users which apps to use and not to use. For regular

> This is a perfectly valid security guard that protects their users No it's not. It's Google telling it's users which apps to use and not to use. For regular users Google presents itself (just like Apple does) as an authority of what's a good app. Any other apps automatically are not good in the mind of regular users.

tokenizerrr 9y ago
When that app gets access to your Google account to do things on your behalf then this is a perfectly valid strategy. Feel free to not integrate with Google's OAuth system if you don't want to deal with them.
- bjpbakker 9y ago
  > Feel free to not integrate with Google's OAuth system if you don't want to deal with them Sorry but that's a bit of an ignorant non-argument. Given the size of Google, I believe that it is important that users can use the apps they want, not the apps that Google wants them to use. Protectionism does not make using Google's services more secure. It serves Google, not its users.
  - tokenizerrr 9y ago
    Do you understand what type of apps we are talking about here? It's not Chrome apps. It's not android apps either. It's apps that make use of Google's OAuth connection to do stuff on behalf of the user. So, don't use that if you don't want to deal with the very legitimate security checks. Again, this is NOT about Android or Chrome apps. So yeah, go use whatever apps you want, as long as it doesn't want the users to grant the developer permission to do stuff with the user's Google account, this does not affect you in the slightest.
    - bjpbakker 9y ago
      This is any web app that /you/ granted access to your Google account details (or a wider scope). If you don't want a web app to access your account, then don't grant access. It really is that simple. Now there's an extra step: Google's stamp of trust. I agree that for most web app this will be an extra formality. For me personally the key point is that there will be web apps that Google does not agree with from a business POV. That is my real problem with this. If this list was curated by a community rather that Google, I would not have a problem with it.
      - tokenizerrr 9y ago
        Everyone can make such an app. A malware site can just redirect an user to that page, and the user thinks they have to log in. They do so. Most users aren't very tech savvy. For apps that aren't vetted you have to confirm that you really intended to give them access. This is good! It protects most users who aren't a genius like yourself. Even if you're not verified, users can still grant your app access! Nothing is blocked! Google just wants to be sure the user realizes what is going on.
      - vitus 9y ago
        I mean, I see this as a culmination of the response to the OAuth phishing attack that happened a few months ago [0]. Red flags should go up if you were accessing a site yesterday via OAuth, and all of a sudden today on the same site you get an angry full-page alert that "so-and-so wants your credentials, but they haven't been verified yet". I also noticed the presence of the domain name on the OAuth page, which certainly helps but is probably not widely noticed in practice. It's certainly worth acknowledging that even if users aren't truly blocked, they may be turned away from legitimate apps that just haven't gone through the review process yet -- too many extra clicks, concerns about the legitimacy of the app, whatever. I wonder how this in particular differs from the vetting process for any mobile app store (Apple's App Store in particular comes to mind with its reputation as a walled garden [1], but Android does also warn the user when enabling the installation of third-party apps not on the Play Store). [0] http://www.pcworld.com/article/3194816/security/google-docs-phishing-attack-underscores-oauth-security-risks.html http://www.pcworld.com/article/3194816/security/google-docs-... [1] https://en.wikipedia.org/wiki/IOS_app_approvals https://en.wikipedia.org/wiki/IOS_app_approvals Disclaimer: while I work at Google, I have nothing to do with OAuth or any other user-facing interface.
GrinningFool 9y ago
> No it's not. It's Google telling it's users which apps to use and > not to use. For regular users Google presents itself (just like Apple does) > as an authority of what's a good app. It's not a good app/bad app question. It's a "can I trust the person who built this app with access to my private data" question that this is attempting to help with. It's not about good apps/bad apps - it's about access to your data. Including data that could be very sensitive. The validation process does not look onerous: https://support.google.com/code/contact/oauth_app_verification https://support.google.com/code/contact/oauth_app_verificati... It's an extra step, and therefore probably frustrating to a number of people - but I have a hard time seeing how taking a few minutes to declare your intentions around private data usage with the entity supplying that data for your use is a bad thing. I hope other OAuth providers go in a similar direction - that way developers don't just go with "easier" paths that are less secure for their users.

tokenizerrr 9y ago

When that app gets access to your Google account to do things on your behalf then this is a perfectly valid strategy. Feel free to not integrate with Google's OAuth system if you don't want to deal with them.

bjpbakker 9y ago
> Feel free to not integrate with Google's OAuth system if you don't want to deal with them Sorry but that's a bit of an ignorant non-argument. Given the size of Google, I believe that it is important that users can use the apps they want, not the apps that Google wants them to use. Protectionism does not make using Google's services more secure. It serves Google, not its users.
- tokenizerrr 9y ago
  Do you understand what type of apps we are talking about here? It's not Chrome apps. It's not android apps either. It's apps that make use of Google's OAuth connection to do stuff on behalf of the user. So, don't use that if you don't want to deal with the very legitimate security checks. Again, this is NOT about Android or Chrome apps. So yeah, go use whatever apps you want, as long as it doesn't want the users to grant the developer permission to do stuff with the user's Google account, this does not affect you in the slightest.
  - bjpbakker 9y ago
    This is any web app that /you/ granted access to your Google account details (or a wider scope). If you don't want a web app to access your account, then don't grant access. It really is that simple. Now there's an extra step: Google's stamp of trust. I agree that for most web app this will be an extra formality. For me personally the key point is that there will be web apps that Google does not agree with from a business POV. That is my real problem with this. If this list was curated by a community rather that Google, I would not have a problem with it.
    - tokenizerrr 9y ago
      Everyone can make such an app. A malware site can just redirect an user to that page, and the user thinks they have to log in. They do so. Most users aren't very tech savvy. For apps that aren't vetted you have to confirm that you really intended to give them access. This is good! It protects most users who aren't a genius like yourself. Even if you're not verified, users can still grant your app access! Nothing is blocked! Google just wants to be sure the user realizes what is going on.
    - vitus 9y ago
      I mean, I see this as a culmination of the response to the OAuth phishing attack that happened a few months ago [0]. Red flags should go up if you were accessing a site yesterday via OAuth, and all of a sudden today on the same site you get an angry full-page alert that "so-and-so wants your credentials, but they haven't been verified yet". I also noticed the presence of the domain name on the OAuth page, which certainly helps but is probably not widely noticed in practice. It's certainly worth acknowledging that even if users aren't truly blocked, they may be turned away from legitimate apps that just haven't gone through the review process yet -- too many extra clicks, concerns about the legitimacy of the app, whatever. I wonder how this in particular differs from the vetting process for any mobile app store (Apple's App Store in particular comes to mind with its reputation as a walled garden [1], but Android does also warn the user when enabling the installation of third-party apps not on the Play Store). [0] http://www.pcworld.com/article/3194816/security/google-docs-phishing-attack-underscores-oauth-security-risks.html http://www.pcworld.com/article/3194816/security/google-docs-... [1] https://en.wikipedia.org/wiki/IOS_app_approvals https://en.wikipedia.org/wiki/IOS_app_approvals Disclaimer: while I work at Google, I have nothing to do with OAuth or any other user-facing interface.

GrinningFool 9y ago

> No it's not. It's Google telling it's users which apps to use and > not to use. For regular users Google presents itself (just like Apple does) > as an authority of what's a good app. It's not a good app/bad app question. It's a "can I trust the person who built this app with access to my private data" question that this is attempting to help with. It's not about good apps/bad apps - it's about access to your data. Including data that could be very sensitive. The validation process does not look onerous: https://support.google.com/code/contact/oauth_app_verification https://support.google.com/code/contact/oauth_app_verificati... It's an extra step, and therefore probably frustrating to a number of people - but I have a hard time seeing how taking a few minutes to declare your intentions around private data usage with the entity supplying that data for your use is a bad thing. I hope other OAuth providers go in a similar direction - that way developers don't just go with "easier" paths that are less secure for their users.