3 ms·
I’d just be happy if Google made it harder for third parties implementing “login with google” to not get access to your entire org’s user list (when the org use
by zaidf 8y ago
I’d just be happy if Google made it harder for third parties implementing “login with google” to not get access to your entire org’s user list (when the org uses gsuite.)
- tgsovlerkhgsel 8y agoCan you elaborate? I thought "login with Google" meant a pretty useless token (granting access to that user's basic profile info). Can additional OAuth scopes be requested and do the third parties request the contacts permission, then harvest the organizations' contacts, and is there no setting in the admin menu to prevent either the OAuth grant or the contact access?
- zaidf 8y agoLots of SaaS companies have a “sign up with google” button which gives them access to the employee directory assuming your org uses google suite. It’s unfortunate yesteryear’s shit growth hack for consumer apps is reappearing in a worse way.