3 ms·

> We use OAuth to sync with your Gmail inbox so we’ll never ask for the password to your inbox. Fuck. No. If this is (and to be honest I didn't read it that c

> We use OAuth to sync with your Gmail inbox so we’ll never ask for the password to your inbox. Fuck. No. If this is (and to be honest I didn't read it that closely) just about making a particular email public, why not just have an inbound address? submit@fwdeveryone.com I'd actually consider using a service that did that.

omeid2 8y ago
They want that juicy juicy inbox data. Nope. Nope. Nope.
- hymen0ptera 8y ago
  This, just as we find out that sometimes, authorized "apps" are just proxies for mechanical turks, and people's eyes are reading your messages. [0] [0] https://news.ycombinator.com/item?id=17446459 https://news.ycombinator.com/item?id=17446459
- yellowapple 8y ago
  Agreed 100%. The premise of this service is already sketchy enough as-is; in light of the neverending parade of seemingly-benign "services" that eventually turn around and sell out their users to advertising agencies and the like, I have precisely zero reason to trust that FWD:Everyone will be any different in that regard.
Alex3917 8y ago
> why not just have an inbound address? We'd love to! Unfortunately going from just the last email in the thread to being able to reconstruct the entire thread would be exceedingly difficult. Also, being able to use DKIM / SPF / DMARC / ARC to ensure the authenticity of conversations is very important to us. If you get a permission request from our site, we want you to be 100% confident that what you see when you preview the thread is going to be what you actually wrote, and that the uploader wasn't able to change the text at all. We support making redactions and anonymizing folks, but are strongly against people being able to change the text of what they or others wrote after the fact. The whole magic of the site is being able to have the experience of looking over other people's shoulders into their inbox, and seeing how they actually talk with one another when they're not on stage. We're all for reducing friction, but we'd rather do it by just making a really slick Add-on so that we don't have to compromise on that core value. As for the Gmail OAuth situation, I completely agree and have been raising awareness of this on HN since long before this became a big issue the other day. You can see my tickets requesting narrower OAuth scopes here: https://issuetracker.google.com/issues?q=reporter:alex.krupp@gmail.com https://issuetracker.google.com/issues?q=reporter:alex.krupp...
- omeid2 8y ago
  > Also, being able to use DKIM / SPF / DMARC / ARC to ensure the authenticity of conversations is very important to us. Are you sure you have really tried? when you forward an email, it includes all the headers you need to for your validations.
  - Alex3917 8y ago
    It only includes the headers of the last email in the thread. But that doesn't guarantee that the person forwarding the email hasn't changed what someone else wrote in the quoted reply text. To me that's actually a serious security issue, and in the long term is more serious than the OAuth thing (which I'm confident that Google will eventually fix). If I'm wrong and it's possible to do then by all means I'll do it though. The one approach that would work is building an InboxSDK plugin and having it forward every message in a thread automatically, because that way you'd have the header of each message. But then the security story is arguably much worse than OAuth.
    - omeid2 8y ago
      I don't believe that is correct. If you check the email source, it includes all the emails with their headers.
      - Alex3917 8y ago
        What email client are you using? In Gmail the only thing I see between quoted replies are blocks like: --000000000000061f91056a2a279c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
  - aidenn0 8y ago
    I'm pretty sure most mail clients will not directly include any of the headers from the original e-mail, unless you do "forward as attachment"
    - deleted 8y ago

omeid2 8y ago

They want that juicy juicy inbox data. Nope. Nope. Nope.

hymen0ptera 8y ago
This, just as we find out that sometimes, authorized "apps" are just proxies for mechanical turks, and people's eyes are reading your messages. [0] [0] https://news.ycombinator.com/item?id=17446459 https://news.ycombinator.com/item?id=17446459
yellowapple 8y ago
Agreed 100%. The premise of this service is already sketchy enough as-is; in light of the neverending parade of seemingly-benign "services" that eventually turn around and sell out their users to advertising agencies and the like, I have precisely zero reason to trust that FWD:Everyone will be any different in that regard.

Alex3917 8y ago

> why not just have an inbound address? We'd love to! Unfortunately going from just the last email in the thread to being able to reconstruct the entire thread would be exceedingly difficult. Also, being able to use DKIM / SPF / DMARC / ARC to ensure the authenticity of conversations is very important to us. If you get a permission request from our site, we want you to be 100% confident that what you see when you preview the thread is going to be what you actually wrote, and that the uploader wasn't able to change the text at all. We support making redactions and anonymizing folks, but are strongly against people being able to change the text of what they or others wrote after the fact. The whole magic of the site is being able to have the experience of looking over other people's shoulders into their inbox, and seeing how they actually talk with one another when they're not on stage. We're all for reducing friction, but we'd rather do it by just making a really slick Add-on so that we don't have to compromise on that core value. As for the Gmail OAuth situation, I completely agree and have been raising awareness of this on HN since long before this became a big issue the other day. You can see my tickets requesting narrower OAuth scopes here: https://issuetracker.google.com/issues?q=reporter:alex.krupp@gmail.com https://issuetracker.google.com/issues?q=reporter:alex.krupp...

omeid2 8y ago
> Also, being able to use DKIM / SPF / DMARC / ARC to ensure the authenticity of conversations is very important to us. Are you sure you have really tried? when you forward an email, it includes all the headers you need to for your validations.
- Alex3917 8y ago
  It only includes the headers of the last email in the thread. But that doesn't guarantee that the person forwarding the email hasn't changed what someone else wrote in the quoted reply text. To me that's actually a serious security issue, and in the long term is more serious than the OAuth thing (which I'm confident that Google will eventually fix). If I'm wrong and it's possible to do then by all means I'll do it though. The one approach that would work is building an InboxSDK plugin and having it forward every message in a thread automatically, because that way you'd have the header of each message. But then the security story is arguably much worse than OAuth.
  - omeid2 8y ago
    I don't believe that is correct. If you check the email source, it includes all the emails with their headers.
    - Alex3917 8y ago
      What email client are you using? In Gmail the only thing I see between quoted replies are blocks like: --000000000000061f91056a2a279c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
- aidenn0 8y ago
  I'm pretty sure most mail clients will not directly include any of the headers from the original e-mail, unless you do "forward as attachment"
  - deleted 8y ago