8 ms·
Software developers scan emails of users who sign up for email-based services
- hodgesrm 8y agoIt appears you can block app access by going to the "Apps with account access" page under 'Sign-in & Security' on your Google account page. I just checked on one of my accounts and there are a few apps like WordPress with basic profile access. This page is hard to find and it's even harder to parse the meaning of the current settings, let alone track changes to them over time.
- blakesterz 8y agoThat page has a bunch of interesting stuff! I assume this link works for all accounts? https://myaccount.google.com/security?pli=1 https://myaccount.google.com/security?pli=1
- pietroglyph 8y agoWouldn't it be https://myaccount.google.com/security?pli=1#connectedapps https://myaccount.google.com/security?pli=1#connectedapps
- blakesterz 8y agoYep, didn't notice you can anchor that. Same page, better link.
- ljw1001 8y agothanks. just deleted access for a couple of apps I used years ago and forgot. Never again.
- jsnell 8y agoIt shouldn't be that hard to find. Google seems to occasionally send out a link to the security checkup tool that has a summary of all the authorized apps / logged in devices [0]. Judging from the other items I'm seeing there, authorizing any apps for reading email would likely be highlighted in red. [0] https://myaccount.google.com/security-checkup https://myaccount.google.com/security-checkup
- kanox 8y agoWait, apps can really read emails? As in the text of emails? Even archived emails? Because for a lot of people that contains a ton of "password reset" emails with new passwords in plain text.
- some_account 8y agoIt's Google. I feel like everybody has been brainwashed into thinking Google is awesome and I'm looking at it from a distance, thinking how did they do this.... Tech conferences? Yearly Google io PR? Somehow people is treating this ad company like they are good guys.
- tdb7893 8y agoI'm a little surprised at this sentiment because they are also very often vilified here. For pretty much everything they do you can find a few comments about how what they are doing is evil.
- smt88 8y agoThey're vilified here, but "here" is an unusual place that doesn't represent the vast majority of Google users
- vorpalhex 8y agoAt one point, Google was pretty not-evil. They had the capacity for great evil, but generally didn't use it. That has obviously changed over the past couple years, in a slow creeping way.
- Hnrobert42 8y agoHow is it a secret?
- brootstrap 8y agoi've been trying to explain this to my wife for a while and struggle with it lol. I get all grumpy and oldman like during tech commercials nowadays saying "pssh that isnt AI!". The other idea that is hard to comprehend is just how much data people have. They most likely dont really know what a 'data center' is and the scale of it. They dont see all of the apps/programs we use like we do, it is magic to them and the consumers are constantly getting 'swindled' by a bunch of hype-drivin buzzword mumbo jumbo.
- cremp 8y agoI do the same thing. My SO's response is generally along the lines of 'I'm fine with it, because it isn't in the hands of anyone I know. If you go out and buy that information, that's creepy and scary because you know me.' I've started coming to terms with the fact that I won't be able to convince her of anything with privacy; because she isn't a technical person, and just like users; they won't care how/why/what cost so long as they can do what they want.
- craftyguy 8y agoYou could always offer to take off all the window curtains/shutters in the house, take down all fences around the property, and leave all windows/doors unlocked. Your SO should be fine with that since it's likely that most of the people that pass by are not people they know.
- crysin 8y agoThis does nothing to help convince people that data privacy is important. Physical privacy and data privacy are two very distinct ideas that have very different implications in people's lives. Please don't conflate the two as if they're equally important and you can't value one without having to value the other.
- luhn 8y agoDoes anybody have a non-paywall link? Edit: Found this re-reporting of the story: http://www.businessinsider.com/google-allows-app-developers-to-read-peoples-gmails-report-2018-7 http://www.businessinsider.com/google-allows-app-developers-...
- lwhsiao 8y agoTwo options for passing the paywall: 1. Facebook trick: https://www.fullwsj.com/articles/techs-dirty-secret-the-app-developers-sifting-through-your-gmail-1530544442 https://www.fullwsj.com/articles/techs-dirty-secret-the-app-... 2. Decluttered via Outline: http://outline.com/gZTuBC http://outline.com/gZTuBC
- balls187 8y ago3. Click the "web" link underneath the title link.
- neonate 8y agoHere you go: http://archive.is/CZFiG http://archive.is/CZFiG
- danpalmer 8y agoI know of at least one startup who do this and use a "machine learning algorithm" to find details of particular things in your inbox. That "algorithm" is a guy in their office. He reads your email. He searches it for common keywords, uses some regexes, but ultimately reads your email, then copies bits out into the system. I'm all for bootstrapping with things that don't scale, but this example was a bad-faith use of Gmail access. I'm glad I don't use Gmail so couldn't accidentally give a random guy access to my inbox.
- enieslobby 8y agoIt's very hard to accidentally give a random guy access to your Gmail inbox. Doing so would require you to opt in to a dialog clearly and explicitly stating that you are giving said permission to a developer.
- rob_b 8y agoYou’re dismissing the observation that users habitually click accept or continue when prompted with a dialog. Sure, you can blame this on the users being lazy but it becomes ingrained into users when everything they access has a dialog, especially when that contains terms of service that would be twenty pages long in paper form (slight exaggeration). I cannot even count the number of times I’ve had conversations with people when observing this behavior. So many users inherently trust that what they’re agreeing to is not only safe, but widely accepted. After all, why else would the service be so popular and have so many users—“Someone out there had to make sure this was legit before me.”
- tedeh 8y agoIm suggesting a UI feature same as the one Github has when deleting repos: clearly input the full name of the repo, or in this case, maybe input ”I UNDERSTAND” in order to proceed. This could be a browser plugin maybe... Access to my personal email would be pretty much security game over for me as far as I can tell. Other people might feel otherwise.
- danpalmer 8y ago
- cherioo 8y agoI don't understand the negativity in this thread. The whole point of email based service is to read users' email. Should we be categorically rejecting a class of application? How much value is privacy vs. value of those services?
- deleted 8y ago[deleted]
- __jal 8y ago> Should we be categorically rejecting a class of application? What you mean, "we"? I categorically reject any third party getting their nose in my email, including Google. > How much value is privacy vs. value of those services? Correcting the question to "is the loss of privacy worth the value provided", again, my answer is absolutely not. On this point, though, it is less about 'privacy' than it is trust. How much do you trust some random startup techbros with more entitlement than sense with everything in your inbox? Not that that's every startup, but it is enough of them. But in general, I frankly don't understand why anyone invites random third parties to read their mail. That's crazy to me. Maybe select family, or (if I were way richer) agents with a contractual relationship.
- protonimitate 8y ago>>But in general, I frankly don't understand why anyone invites random third parties to read their mail. That's crazy to me. Maybe select family, or (if I were way richer) agents with a contractual relationship. It's ignorance, plain and simple. Most people (even those with tech experience) don't understand, or care, about the reach of that the companies they rely on have. Convenience comes at a price, always. Even if Google were to simplify their ToS and app permission notices as much as possible, a good portion of users would blindly click 'o.k.' and move on.
- virtuabhi 8y agoI use Google/Gmail account to login into multiple apps. All the apps have some of these three permissions - (1) View your basic profile info (2) View your email address (3) View your phone numbers. Are these permissions strictly enforced? I know that Google employees can read my emails (under some specific cases), but can third party app developers also read my emails?
- jopsen 8y agoI'm pretty sure this is strongly enforced, and it's unfair that the article doesn't highlight this.
- TheAceOfHearts 8y agoPermissions are strictly enforced and third party developers can't read your emails with the ones you mentioned.
- Alex3917 8y ago> Are these permissions strictly enforced? Yes, each of those items corresponds to an OAuth scope. If you try to make an API call for data that isn't covered by the OAuth scopes you have access to, you'll just get an error. Developers can add broader OAuth scopes to their apps at any point, but if they do then all their users will need to re-authenticate and will see that the app now requires additional permissions. C.f.: https://developers.google.com/gmail/add-ons/concepts/scopes https://developers.google.com/gmail/add-ons/concepts/scopes
- hirsin 8y agoNo. For this app to get access to your email you would have to click through a prompt saying "this app can read all of your email". The profile, email, and OpenID scopes are just profile info. Still sometimes more info than is needed by the relying party (you don't really need to know my gender), but tightly scoped and enforced by any OAuth provider.
- deleted 8y ago[deleted]
- TrueSelfDao 8y ago
- nisten 8y agoThis is getting quite irresponsible and sad. The reason nothing too terrible(apart from election tampering) has yet happened is simply because the current market demand for developers prevents us from engaging in malicious behaviour. However, once there's a market downturn, this data will be used for criminal purposes in no time. The malware industry in east european countries with good engineering talent exploded in the 90s after their economies collapsed. But who cares right? I feel like this level of naivety towards powering interoperability with brute openness today is just plain stupid and will lead towards a backlash or risk all out witch-hunt against developers and intellectuals in general. That risk is becoming unacceptable in my opinion and it is worth it to start regulating a bit our profession.
- justinclift 8y ago> The reason nothing too terrible(apart from election tampering) has yet happened is simply because the current market demand for developers prevents us from engaging in malicious behaviour. That doesn't seem to be how humans work. Groups that want to do malicious stuff are able to hire people too (eg electon tampering as you mention). They'd probably have to direct their hiring efforts differently though. Probably towards known areas of er... scum and villany? ;) Seriously though, they managed to hire people for the electon tampering, so at least it shows it can be done.
- nisten 8y agoYes it can be done, but the probability of malicious players finding someone competent enough is quite low. It's unlikely you would help a shady organization when you have a high salary and a nice life. However this also means that security relies on the state of the market rather than on good code.
- Ivoirians 8y agoBreaking news: Third parties scan full transaction histories and balances from bank accounts of users who sign up for financial planning services (e.g. Mint). The WSJ really knows how to write misleading, incendiary headlines about tech companies. Like, just read that comment section. Gotta stoke that techlash. Plenty of people have plenty of real reasons to hate Google, but hit pieces designed to drive the non-technical (and apparently some HN readers) to think "Oh no, my Gmails are being sold and read by people"--I guess it's too effective of a strategy to pass up. Just an utter shame. There is a real problem here, that lots and lots of users that glaze over the "This app can manage (view, send, delete) all of your emails" permission setting without thinking about it. I mean, even I double checked my permissions to make sure I hadn't accidentally given my email access away to a random plugin. What do you do about normal users (like my parents) who will gladly click Next and Confirm on every single popup in front of them, without even attempting to read it?
- h000per 8y agoIts not just Google, Microsoft Office 365 also supports the use of Oauth tokens to read email.
- auslander 8y agoOriginal article title is "Tech’s ‘Dirty Secret’: The App Developers Sifting Through Your Gmail" Could moderators fix it, please?
- auslander 8y agoApple iOS does not have permission for apps to access emails at all, if I'm not mistaken.