3 ms·

I use Google/Gmail account to login into multiple apps. All the apps have some of these three permissions - (1) View your basic profile info (2) View your email

I use Google/Gmail account to login into multiple apps. All the apps have some of these three permissions - (1) View your basic profile info (2) View your email address (3) View your phone numbers. Are these permissions strictly enforced? I know that Google employees can read my emails (under some specific cases), but can third party app developers also read my emails?

jopsen 8y ago
I'm pretty sure this is strongly enforced, and it's unfair that the article doesn't highlight this.
TheAceOfHearts 8y ago
Permissions are strictly enforced and third party developers can't read your emails with the ones you mentioned.
Alex3917 8y ago
> Are these permissions strictly enforced? Yes, each of those items corresponds to an OAuth scope. If you try to make an API call for data that isn't covered by the OAuth scopes you have access to, you'll just get an error. Developers can add broader OAuth scopes to their apps at any point, but if they do then all their users will need to re-authenticate and will see that the app now requires additional permissions. C.f.: https://developers.google.com/gmail/add-ons/concepts/scopes https://developers.google.com/gmail/add-ons/concepts/scopes
hirsin 8y ago
No. For this app to get access to your email you would have to click through a prompt saying "this app can read all of your email". The profile, email, and OpenID scopes are just profile info. Still sometimes more info than is needed by the relying party (you don't really need to know my gender), but tightly scoped and enforced by any OAuth provider.
deleted 8y ago
[deleted]
TrueSelfDao 8y ago
The apps that require permission to read your email and ask for it. They generally provide services like - Act as a desktop mail client - Backup your SMS messages to Gmail - Search your email for forgotten registrations and allow you to cancel Ideally it should be clear from the context that the app requires this permission. But the problems that plague mobile app and browser extension permission systems exist here as well. The stakes may even be higher.

jopsen 8y ago

I'm pretty sure this is strongly enforced, and it's unfair that the article doesn't highlight this.

TheAceOfHearts 8y ago

Permissions are strictly enforced and third party developers can't read your emails with the ones you mentioned.

Alex3917 8y ago

> Are these permissions strictly enforced? Yes, each of those items corresponds to an OAuth scope. If you try to make an API call for data that isn't covered by the OAuth scopes you have access to, you'll just get an error. Developers can add broader OAuth scopes to their apps at any point, but if they do then all their users will need to re-authenticate and will see that the app now requires additional permissions. C.f.: https://developers.google.com/gmail/add-ons/concepts/scopes https://developers.google.com/gmail/add-ons/concepts/scopes

hirsin 8y ago

No. For this app to get access to your email you would have to click through a prompt saying "this app can read all of your email". The profile, email, and OpenID scopes are just profile info. Still sometimes more info than is needed by the relying party (you don't really need to know my gender), but tightly scoped and enforced by any OAuth provider.

deleted 8y ago

[deleted]

TrueSelfDao 8y ago

The apps that require permission to read your email and ask for it. They generally provide services like - Act as a desktop mail client - Backup your SMS messages to Gmail - Search your email for forgotten registrations and allow you to cancel Ideally it should be clear from the context that the app requires this permission. But the problems that plague mobile app and browser extension permission systems exist here as well. The stakes may even be higher.