3 ms·

Most users of these products are non-technical, among other things. They have no idea that they should even consider that something like that is happening. > i

Most users of these products are non-technical, among other things. They have no idea that they should even consider that something like that is happening. > i've been trying to explain this to my wife for a while and struggle with it lol. A losing battle, it seems. I find people can't make the pattern connections about good and bad hygiene. So explaining one example doesn't prevent similar behavior in another, even for really "obvious" stuff. Kinda drives me a little crazy.

tomashertus 8y ago
Users don't read. There are Consent screen which clearly explain what kind of access the application will have to your Google Account. Edit: Formatting & Spelling
- hodgesrm 8y ago
  That said, there's a difference between understanding what privilege you are granting and understanding the implications of that grant. For instance, Google help pages [0] just talk about "Full account access" and "View your basic profile information." What about apps that can view your calendar? That's in between. What information do those apps actually see? What can somebody do with the information that I might not like? These are hard questions to answer with the information Google gives you. [0] https://support.google.com/accounts/answer/3466521?hl=en https://support.google.com/accounts/answer/3466521?hl=en
  - inetknght 8y ago
    > understanding the implications of that grant Grant an application permission because it asked to in order to fulfill a request to handle one particular thing about one particular email. Instead, grant access to your entire email account, not get notified of which emails the application accessed, and get upset because the application exceeded what you desired to grant.
- Spooky23 8y ago
  I don't think Google is a villain here, except for the lack of fine grained access control common to all cloud apps. For example, I had enabled IFFT to record something to a Google Sheet periodically. I didn't realize that in doing that, I gave the company unfettered access to my entire corpus of data.
crispyambulance 8y ago
Technical users or not, the implications need to be MORE CLEARLY spelled out. Putting it on the user to figure out the implications of some obscured click-through garbage text isn't fair. There is a big difference between, say, a 3rd party application using a google API to work with anonymized keyword data from a gmail accounts VERSUS an actual person being able to browse someone else's gmail inbox. If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED.
- Alex3917 8y ago
  > If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED. Within the last year Google changed their OAuth policies so that you need approval from Google before you can publish an app that uses OAuth. One of the requirements for this is linking to your privacy policy, where you need to say how the data is going to be used.

tomashertus 8y ago

Users don't read. There are Consent screen which clearly explain what kind of access the application will have to your Google Account. Edit: Formatting & Spelling

hodgesrm 8y ago
That said, there's a difference between understanding what privilege you are granting and understanding the implications of that grant. For instance, Google help pages [0] just talk about "Full account access" and "View your basic profile information." What about apps that can view your calendar? That's in between. What information do those apps actually see? What can somebody do with the information that I might not like? These are hard questions to answer with the information Google gives you. [0] https://support.google.com/accounts/answer/3466521?hl=en https://support.google.com/accounts/answer/3466521?hl=en
- inetknght 8y ago
  > understanding the implications of that grant Grant an application permission because it asked to in order to fulfill a request to handle one particular thing about one particular email. Instead, grant access to your entire email account, not get notified of which emails the application accessed, and get upset because the application exceeded what you desired to grant.
Spooky23 8y ago
I don't think Google is a villain here, except for the lack of fine grained access control common to all cloud apps. For example, I had enabled IFFT to record something to a Google Sheet periodically. I didn't realize that in doing that, I gave the company unfettered access to my entire corpus of data.

crispyambulance 8y ago

Technical users or not, the implications need to be MORE CLEARLY spelled out. Putting it on the user to figure out the implications of some obscured click-through garbage text isn't fair. There is a big difference between, say, a 3rd party application using a google API to work with anonymized keyword data from a gmail accounts VERSUS an actual person being able to browse someone else's gmail inbox. If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED.

Alex3917 8y ago
> If Google makes it possible for some 3rd party asshole to peruse the gmail inboxes of whoever uses the service, that should be UPFRONT and VERY CLEARLY STATED. Within the last year Google changed their OAuth policies so that you need approval from Google before you can publish an app that uses OAuth. One of the requirements for this is linking to your privacy policy, where you need to say how the data is going to be used.