4 ms·

Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter

by CM30 8y ago

Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter how 'legit' the company is or what not.

nixpulvis 8y ago
Not that I disagree with you but, do you... - host your own email... - on your own hardware... - with your own software (hopefully doing end to end encryption) Even then your surely not running your own fiber, though things like STARTTLS help mitigate this vector. I only mean to say, some level of trust is assumed. But yea, you should aim towards less buggy, evil corporate dependencies.
CobrastanJorji 8y ago
I've used TripIt. Reading your email is central to their "magic." The idea is that whenever you get any sort of travel confirmation, they automatically ingest it and compile all the info into trips, then handle stuff like reminding you to checkin, auto-filling up your checkin code, suggesting seats, etc. They also have an alternative for the privacy-minded where you just forward any confirmation emails you want them to know about and the same stuff happens, but for the email address I was using for this, there wasn't anything I was worried about them accessing, and this was easier.
- mrcodedude 8y ago
  My workaround for this is to set up a dummy email address that I use for all travel. That email address then forwards the emails to both plans@tripit.com and my personal email address.
  - nhumrich 8y ago
    You could also use gmails + feature. My.name+travel@gmsil.com and have those forward to trip it.
drusepth 8y ago
This sounds conceptually right and I would definitely agree with it... if I haven't given multiple sites access to my email over the years. Anything that interacts with your email is going to need it, and if you're signing up for that service odds are you know (or at least assume) it'll need some kind of access to your email. For example, I used unroll.me for years, which gives you a singular interface to block spam and fake subscriptions -- for these kinds of emails, there's often no (working) unsubscribe link. Unroll.me works by looking at each incoming email and, if it's from someone you've blocked, automatically deletes the email. Similarly, it has other services that operate on emails you receive, like bundling up multiple emails into one (which, on the backend, deletes thoseincoming emails and concatenates them into a singular email with them all later). It's easy to say "i'll never give a third party app access to my email", but for most people it comes down to the age old problem of trading data for services/conveniences that you find valuable. Side-note: There've been many rumors over the years that Unroll.me sells information about the emails it scans. I think it's even more telling of the "trade data for service" paradigm that people continue to use the service even after finding out.
- cosmie 8y ago
  > There've been many rumors over the years that Unroll.me sells information about the emails it scans. It's not just rumors, it's stated clearly (if in softened terms) on the site now[1]. Although it wasn't for the first few years, as their original monetization model wasn't based on it. The big stink about it was that they shifted to that model silently. The original founder only monetized it in a straightforward manner via ads in the app. Then it was sold to Slice/Rakuten, and they silently incorporated it as part of Slice's consumer intelligence data, along with data from other subsidiaries they bought such as Ebates. Small aside: Rakuten also has a major stake in Acorn[2]. Acorn uses Plaid to verify bank account information for payouts. Plaid[3] is incredibly handy from a consumer experience, but the implications are scary from an "alternative use" perspective. Once connected, there are several handy Plaid products[4] which can make use of that authorization, above and beyond just confirming account ownership. Such as continuously siphoning off transaction level records or keeping tabs on income and employment fluctuations[5]. Not that Rakuten is leveraging their stake in Acorn to access Acorn's bank authorization for those ulterior uses. But it's food for thought on what possibilities exist. > I think it's even more telling of the "trade data for service" paradigm that people continue to use the service even after finding out I agree wholeheartedly with this assessment. Although I wonder how much their subscriber growth rate changed after their alternative data use came to light. [1] https://unroll.me/your-data https://unroll.me/your-data [2] https://techcrunch.com/2016/04/21/paypal-invests-30-million-in-acorns-investing-app/ https://techcrunch.com/2016/04/21/paypal-invests-30-million-... [3] https://plaid.com/ https://plaid.com/ [4] https://plaid.com/products/ https://plaid.com/products/ [5] https://plaid.com/products/income https://plaid.com/products/income
HALtheWise 8y ago
Do you apply that constraint to browser extensions as well? "Access and modify all site data" definitely includes your email, and is required by a fair number of useful extensions including all adblockers that I know of.
- JetSpiegel 8y ago
  Only if you read your email in the browser.

by CM30 8y ago

Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter how 'legit' the company is or what not.

nixpulvis 8y ago

Not that I disagree with you but, do you... - host your own email... - on your own hardware... - with your own software (hopefully doing end to end encryption) Even then your surely not running your own fiber, though things like STARTTLS help mitigate this vector. I only mean to say, some level of trust is assumed. But yea, you should aim towards less buggy, evil corporate dependencies.

CobrastanJorji 8y ago

I've used TripIt. Reading your email is central to their "magic." The idea is that whenever you get any sort of travel confirmation, they automatically ingest it and compile all the info into trips, then handle stuff like reminding you to checkin, auto-filling up your checkin code, suggesting seats, etc. They also have an alternative for the privacy-minded where you just forward any confirmation emails you want them to know about and the same stuff happens, but for the email address I was using for this, there wasn't anything I was worried about them accessing, and this was easier.

mrcodedude 8y ago
My workaround for this is to set up a dummy email address that I use for all travel. That email address then forwards the emails to both plans@tripit.com and my personal email address.
- nhumrich 8y ago
  You could also use gmails + feature. My.name+travel@gmsil.com and have those forward to trip it.

drusepth 8y ago

This sounds conceptually right and I would definitely agree with it... if I haven't given multiple sites access to my email over the years. Anything that interacts with your email is going to need it, and if you're signing up for that service odds are you know (or at least assume) it'll need some kind of access to your email. For example, I used unroll.me for years, which gives you a singular interface to block spam and fake subscriptions -- for these kinds of emails, there's often no (working) unsubscribe link. Unroll.me works by looking at each incoming email and, if it's from someone you've blocked, automatically deletes the email. Similarly, it has other services that operate on emails you receive, like bundling up multiple emails into one (which, on the backend, deletes thoseincoming emails and concatenates them into a singular email with them all later). It's easy to say "i'll never give a third party app access to my email", but for most people it comes down to the age old problem of trading data for services/conveniences that you find valuable. Side-note: There've been many rumors over the years that Unroll.me sells information about the emails it scans. I think it's even more telling of the "trade data for service" paradigm that people continue to use the service even after finding out.

cosmie 8y ago
> There've been many rumors over the years that Unroll.me sells information about the emails it scans. It's not just rumors, it's stated clearly (if in softened terms) on the site now[1]. Although it wasn't for the first few years, as their original monetization model wasn't based on it. The big stink about it was that they shifted to that model silently. The original founder only monetized it in a straightforward manner via ads in the app. Then it was sold to Slice/Rakuten, and they silently incorporated it as part of Slice's consumer intelligence data, along with data from other subsidiaries they bought such as Ebates. Small aside: Rakuten also has a major stake in Acorn[2]. Acorn uses Plaid to verify bank account information for payouts. Plaid[3] is incredibly handy from a consumer experience, but the implications are scary from an "alternative use" perspective. Once connected, there are several handy Plaid products[4] which can make use of that authorization, above and beyond just confirming account ownership. Such as continuously siphoning off transaction level records or keeping tabs on income and employment fluctuations[5]. Not that Rakuten is leveraging their stake in Acorn to access Acorn's bank authorization for those ulterior uses. But it's food for thought on what possibilities exist. > I think it's even more telling of the "trade data for service" paradigm that people continue to use the service even after finding out I agree wholeheartedly with this assessment. Although I wonder how much their subscriber growth rate changed after their alternative data use came to light. [1] https://unroll.me/your-data https://unroll.me/your-data [2] https://techcrunch.com/2016/04/21/paypal-invests-30-million-in-acorns-investing-app/ https://techcrunch.com/2016/04/21/paypal-invests-30-million-... [3] https://plaid.com/ https://plaid.com/ [4] https://plaid.com/products/ https://plaid.com/products/ [5] https://plaid.com/products/income https://plaid.com/products/income

HALtheWise 8y ago

Do you apply that constraint to browser extensions as well? "Access and modify all site data" definitely includes your email, and is required by a fair number of useful extensions including all adblockers that I know of.

JetSpiegel 8y ago
Only if you read your email in the browser.