3 ms·
Yeah. I was first employee at a startup that would probably have been the subject of this article if it was still around. dons flame suit We used OAuth to ga
by saryant 8y ago
Yeah. I was first employee at a startup that would probably have been the subject of this article if it was still around.
dons flame suit
We used OAuth to gain access to users' email. We were exceptionally explicit about this—it was the entire point of the service! We only looked at header data but technically we had access to the full text of the email—Google's permissions weren't granular enough for our users to only grant us access to headers.
That was one of our requests to the Gmail team when they announced the Gmail API. I wrote a blog post about its deficiencies from our perspective and one of the engineers on the Gmail team reached out. Mostly, it was just way too slow so we stuck with IMAP.
I was more-or-less running the ingest and storage systems at the time. We were pretty careful and data wasn't shared with any other companies.
IIRC we could access any mailbox/folder in the account.
edit: To be clear, the OAuth prompt clearly says you are granting access to read emails. Yeah, people don't read, but I don't believe we were doing anything wrong.
edit2: Our media coverage (Techcrunch etc) touted the fact we had access to your email—that was the selling point of the entire service! Amazing to me that OAuth has suddenly become evil.
- jsoc815 8y agoThanks for sharing some details on this. While I'm sure it won't help me convince other that this actually happens, it's still good to be able to have a reference.
- Alex3917 8y agoWe use read-only OAuth scope for FWD:Everyone. The security story is actually very good: - Tokens can only be used from servers that have been registered with Google, so even if a startup has their OAuth tokens stolen the attacks can't really make requests on their behalf. - Tokens access has per user and per app rate limits that are configurable in the Google console. - With read-only OAuth access, there isn't really any value to attackers. E.g. if anyone tried to reset your bank passwords, it would be immediately obvious because they wouldn't be able to delete the password reset emails. I'm currently (i.e. today) writing a Gmail Add-on that only requires read-only access to the currently open thread rather than requiring it for your entire inbox. (Basically read-only access is granted when you click the icon to activate the add-on within the currently open thread.) This is something that's become possible in the last six months and is probably a slight improvement from a security perspective, but even the baseline level is pretty solid. The tech industry has yet to see any large OAuth-related security breaches, and frankly we may just never see that given the combination of the good security story and the limited value to attackers.
- reificator 8y ago> With read-only OAuth access, there isn't really any value to attackers. https://en.wikipedia.org/wiki/Fappening https://en.wikipedia.org/wiki/Fappening
- Alex3917 8y agoThat wasn't OAuth-related though, the attackers just guessed or brute forced their iCloud passwords.
- reificator 8y agoI'm not saying OAuth was broken, I'm saying even read only access can be very valuable to an attacker. And not just for celebrities.