3 ms·
This seems fairly similar to the Cambridge Analytica revelation—it seems they’re reporting on access specifically granted to these apps by the user, but the dat
by drb91 8y ago
This seems fairly similar to the Cambridge Analytica revelation—it seems they’re reporting on access specifically granted to these apps by the user, but the data is not technically restricted from access the way you might expect when humans are involved. That is, the person isn’t authorized on access beyond having the app credentials. Does anyone else understand this? Does that sound correct?
If I am correct, we’re going to be facing a long list of shocking APIs. I also wonder why the article doesn’t mention SOX, which might provide some liability for public companies looking at PII.
- kowdermeister 8y agoThe Google oauth page does say that the third party will be able to read, delete your mail. It will boil down to user's assumptions if said third party consists of humans :) Then they will be obviously able to read it. That's why I never provide access to my gmail.
- nqzero 8y agothese apps appear to be doing exactly what they claim to be doing, or at least the articles don't make a claim otherwise and (at least for extensions, google has a strict policy about do-only-on-thing - i just got flagged and thankfully reinstated). CA was quite different - the app appeared to be doing one thing, but was actually doing a very different thing. and from my experience, facebook permissions are so broad as to be useless (which allowed me to make a kinda cool app but is scary) wouldn't be surprised if there are bad apples in this ecosystem too - google can't take their policies too far or it will turn into a walled garden, but for the most part it's just users choosing convenience over sanity