4 ms·
I wish Google would build an OAuth flow that would provide an obfuscated and unique email address to services that need an email address for logins or any commu
by maherbeg 8y ago
I wish Google would build an OAuth flow that would provide an obfuscated and unique email address to services that need an email address for logins or any communication at all.
- zaidf 8y agoI’d just be happy if Google made it harder for third parties implementing “login with google” to not get access to your entire org’s user list (when the org uses gsuite.)
- tgsovlerkhgsel 8y agoCan you elaborate? I thought "login with Google" meant a pretty useless token (granting access to that user's basic profile info). Can additional OAuth scopes be requested and do the third parties request the contacts permission, then harvest the organizations' contacts, and is there no setting in the admin menu to prevent either the OAuth grant or the contact access?
- zaidf 8y agoLots of SaaS companies have a “sign up with google” button which gives them access to the employee directory assuming your org uses google suite. It’s unfortunate yesteryear’s shit growth hack for consumer apps is reappearing in a worse way.