12 ms·
Tell HN: Google removing Gmail access from IFTTT
Hello,
Although you don’t need to take any action, we wanted to let you know that the following third-party apps will no longer be able to access some data in your Google Account, including your Gmail content. This change will go into effect starting March 31, 2019.
IFTTT
We are making this change as part of ongoing efforts to make sure your data is protected and private. These apps haven’t yet complied with our updated data privacy requirements announced on October 8, 2018
You can always view, manage and remove apps you’ve given access to your account by visiting your Google Account.
Thanks,
The Google Accounts team
- kop316 8y agoI'll ask the question, why? You have a vague "they don't comply with our requirements", but you don't actually explain. That could be a happy to glad issue, or it could be a much bigger issue. But this announcement just sounds like the phrase from Empire " I have altered the deal. Pray I don't alter it any further."
- mrosett 8y agoPresumably the poster is just copy/pasting an email and isn't Google.
- pgrote 8y agoCorrect. My apologies as I should have prefaced it with a description indicating it was an email from Google.
- Spooky23 8y agoIFTTT asks for a lot of access. Most people aren’t able to make an informed decision re what that means.
- koboll 8y agoAFAIK, what you do with your own data via IFTTT is entirely up to you. Is there any evidence or indication IFTTT is misusing, or could miuse it? Of course it asks for a lot of permissions -- the idea is that you can use it to replace APIs for everything.
- pgrote 8y ago> Is there any evidence or indication IFTTT is misusing, or could miuse it? Of course it asks for a lot of permissions -- the idea is that you can use it to replace APIs for everything. I have not heard of anything. IFTTT recipes have really made my life nicer through automating certain things, which includes gmail interactions. It'll be a bummer if support cannot continue. I understand Google's changing of the rules, but am surprised IFTTT hasn't been in front of this change.
- danso 8y agoThe litmus test appears to be requirements that Google says IFTTT does not currently meet: > These apps haven’t yet complied with our updated data privacy requirements announced on October 8, 2018
- shkkmo 8y agoIMHO, giving an additional third party access to your main email account which is usually the key to your entire online identify seemed like a major increase in security risks. I think Google's concern is less that IFTTT is going to hack you and more that IFTTT may not be securely handling this data and may be hacked. I would only give IFTTT access to a secondary email address that recieves specific types of emails, possibly automatically forwarded by Gmail's filtering rules.
- citrablue 8y agoMaybe they want to get in front of a possible backlash, like what happened to Facebook when it was revealed that 3rd parties you used to send messages through... had access to the messages! (gasp)
- ams6110 8y agoWhat is IFTTT? Never heard of it.
- saagarjha 8y agoIf This Then That: https://ifttt.com https://ifttt.com. It's a popular personal automation service.
- joefkelley 8y agoContext: In ~July 2018 there was some outcry because Google was "letting third parties read your emails" (e.g. https://www.cbsnews.com/news/google-reportedly-allows-third-party-apps-to-scan-gmail-emails/ https://www.cbsnews.com/news/google-reportedly-allows-third-...). Of course, these were all explicitly installed by users who gave these apps access. But somehow people were mad anyway - maybe users shouldn't be given the option to make choices they don't understand? Anyway, as the message mentions, Google announced new requirements for these apps on October 8: https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems https://cloud.google.com/blog/products/g-suite/elevating-use... Apparently, IFTTT (which does personal automation, integrating with many third parties), does not comply with the new policy.
- deleted 8y ago[deleted]
- chii 8y ago> maybe users shouldn't be given the option to make choices they don't understand? ala brexit!
- mappu 8y agoIf your addon works entirely locally, you only need to be "verified as non-malicious software", but if there is any network component then you need the "full assessment" from an independent 3rd-party auditor: > The assessment fee is paid by the developer and may range from $15,000 to $75,000 (or more) depending on the size and complexity of the application. This fee is due whether or not your app passes the assessment
- abraae 8y agoGood news for IFTT, who presumably can afford to pay this (and could use the results elsewhere). Bad news for smaller players.
- tptacek 8y agoThe low-end of that range is the ballpark for the low-end of the range of security assessments; the $75,000 high-end is very high; a more realistic range would be $15,000-$30,000 for typical SAAS-type functionality. This is simply what professional security assessment costs. There's a lot of competition and a diversity of firms, and this is the range the rates float in. It doesn't make sense that small companies should be allowed to circumvent the requirement when what they're doing is just as sensitive as apps from large companies.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- Vojojo 8y agoAlthough it doesn't necessarily cater for the home market, Zapier is suitable replacement for many use cases IMO.
- amanzi 8y agoWhat's different between the way that Zapier connects to Gmail versus how IFTTT does it? Both appear to use the same mechanism, so I guess that Zapier will get blocked soon too?
- markdown 8y agoNot if Zapier paid for the audit and passed.
- harrisonjackson 8y agoThey will provide you a zapiermail.com email address to forward emails to - https://zapier.com/apps/email https://zapier.com/apps/email
- m-p-3 8y agoIntegromat might also works as an alternative.
- archita 8y agoAutomate.io too can work for this! I guess they've passed this and Gmail Triggers and Actions are working fine. https://automate.io/integration/gmail https://automate.io/integration/gmail
- swiley 8y agoIMAP still works though right? It's strange that IFTTT would use some non-standard interface and that's why I'm asking. I don't think I can keep using gmail if IMAP breaks.
- toomuchtodo 8y agoDisclaimer: Worked someplace that does something similar to IFTTT, but not IFTTT. You do not want to use IMAP for integrations at scale. You run into all sorts of weird issues retrieving and deduplicating messages. It’s a terrible black box to troubleshoot. The Gmail REST interface was a huge improvement over IMAP. If you can get access to the REST interface, you want to use it. While IMAP is a legacy compatibility mode, I would not call it a “standard” interface for this purpose.
- Endy 8y agoPlease define 'at scale' - I use IMAP + SMTP to download all of my personal emails, I avoid REST because it's Google-led. Are you saying my ~5K/mo emails or my employers ~100K/mo emails are "scale"?
- toomuchtodo 8y agoYour personal use case is fine. I’m referring to when 100k+ customers are using it on your platform. FastMail has been championing a new standard (JMAP) for mail messaging; hopefully it gets traction.
- zaphirplane 8y agoWhat is at scale mean? every account has its own connection There is nothing inherently scalable in the imap vs rest layer
- toomuchtodo 8y agoIt’s not about performance scaling (although you do have to contend with those issues, as you’re network and not CPU bound), but about data integrity workload management. Each time a customer submits a ticket because you couldn’t catch an edge case when IMAP polling, that’s someone digging through logs to understand why, and determine if a patch provides ongoing resolution (or if nothing can be done other than an apology). That’s not scalable past a certain point. Hence, (hopefully well supported and documented) REST interfaces.
- matb33 8y agoI got the exact same email but substitute IFTTT for Gmvault, which I use to make backups of my emails.
- gmvault_unnn 8y agoYeah, there's an issue with a few comments already: https://github.com/gaubert/gmvault/issues/335 https://github.com/gaubert/gmvault/issues/335
- crazygringo 8y agoWill IFTTT update to comply? Also, does this prevent sending emails to my Gmail, as opposed to reading? That was what I used the most.
- istjohn 8y agoNo, IFTTT doesn't intend to update to comply. See: https://help.ifttt.com/hc/en-us/articles/360020249393-Important-update-about-Gmail-on-IFTTT https://help.ifttt.com/hc/en-us/articles/360020249393-Import...
- noahmbarr 8y agoThey’ll comply if their users demand it. Time will tell
- GuB-42 8y agoGmail is just another email address. So no problem sending emails to your Gmail.
- solarkraft 8y agoYou mean that the app I explicitly want to be able to manipulate the data I have given it access to will no longer be able to do so? Hm.
- ucaetano 8y agoYep, users made it clear that they can't be trusted to make such decisions, so now the apps have to comply with new requirements, including security audits by 3rd parties.
- tptacek 8y agoWhich is totally sensible. Nobody believes end-users are qualified to assess the security risks of the applications they're opting into. It's a little like being angry at how expensive it is to inspect and qualify an airliner before allowing people to book flights on it.
- freedomben 8y agoWhat are end-users qualified to assess? Should we be able to choose what we want to eat if we aren't qualified nutritionists? People that aren't experts will certainly make poor decisions sometimes, or think they are choosing healthy food when it really isn't. Where do you draw the line?
- ac29 8y agoI think Google actually has taken more or less the right stance here. I'm not entirely sure that most people understand the difference between "click this button to make my app work" and "click this button to make my app work, and oh by the way you are also agreeing to let us sell your data to a marketing firm". Clarifications like the below are good for the vast majority of users (your opinion about Google's own business model aside): "3rd-party apps accessing these APIs must use the data to provide user-facing features and may not transfer or sell the data for other purposes such as targeting ads, market research, email campaign tracking, and other unrelated purposes. (Note: Gmail users’ email content is not used for ads personalization.) As an example, consolidating data from a user’s email for their direct benefit, such as expense tracking, is a permitted use case. Consolidating the expense data for market research that benefits a third party is not permitted. We have also clarified that human review of email data must be strictly limited." [0] [0] https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems https://cloud.google.com/blog/products/g-suite/elevating-use...
- solarkraft 8y agoSo what is the policy update and can IFTTT comply without breaking functionality?
- winkeltripel 8y agoan independent 3rd-party auditor: > The assessment fee is paid by the developer and may range from $15,000 to $75,000 (or more) depending on the size and complexity of the application. This fee is due whether or not your app passes the assessment (snipped from above)
- flocial 8y agoIt's unfortunate that I could get most of the functionality I need if IFTTT offered a way to confirm Gmail's request to add trigger@ifttt as a forwarding address.
- tyingq 8y agoWhat's funny is many of these IFTTT integrations appear to have been written by the Google Gmail team themselves. Like this one, for example: https://ifttt.com/applets/jMfVncBv-press-a-button-to-quickly-email-people-you-re-running-late https://ifttt.com/applets/jMfVncBv-press-a-button-to-quickly...
- soylentgraham 8y agoThat's not an integration, just a task/applet.
- tyingq 8y agoIt's hard to look at it in a way that doesn't seem like Google/Gmail is highly involved: https://ifttt.com/gmail https://ifttt.com/gmail
- Endy 8y agoSo IFTTT, a good service, and if memory serves an HN poster, is being banned from Google. This should be a sign to move away from Google, yes?
- jasonvorhe 8y agoNo. GMail gave people the option of giving full access to their Gmail's mails with the user's consent. This was discovered and made up to be a scandal (people who shouldn't be able to can read your Gmail) which it wasn't. GMail then decided that the API is too dangerous to allow any 3rd party to use it, because once you grant access to someone, your GMail's security is bound to the 3rd party's security. The sensible thing to do was to make the scope of access more clear while granting access to the 3rd party as well as making sure the 3rd party is following security best practices. I don't see how this is Google's fault.
- harrisonjackson 8y agoI use Zapier to do some basic email parsing / echoing important and interesting things into slack and SMS. Instead of giving API access to Gmail content I filter + forward the emails to an address they provide.
- uhsaywhat 8y agoMaybe the goal is to remove IFTTT and build the features into GMAIL
- londons_explore 8y agoThe goal is to not let a Cambridge Analytica scandal happen to Google. If users all choose to share their emails with a third party service, and that third party service leaks/abuses the mail, Google will get blamed. Google doesn't want that, so now stops you choosing to share mail with all except the biggest companies.
- flocial 8y agoHere's IFTTT's statement: https://help.ifttt.com/hc/en-us/articles/360020249393-Important-update-about-Gmail-on-IFTTT https://help.ifttt.com/hc/en-us/articles/360020249393-Import...
- miki123211 8y agoAnd now I will have to write my own thing with imap suport, find a place to host it, integrate with Dropbox's API etc. Thanks, Google. I think I'm seriously moving out.
- deleted 8y ago[deleted]
- deanclatworthy 8y agoA little odd statement. I am in no doubt that it would require "massive back-end & infrastructure changes" as they point out, but this is the business model for IFTTT. They integrate these services as doing it yourself is a pain in the ass.
- icebraining 8y agoYeah, it read as "we've managed to outsource the work and just reap the profits, and now Google wants us to work again? Nope!"
- dboreham 8y agoI run a company that, among other things, provides a service for GMail users that depends on mailbox access. We did have to jump through a few hoops to retain our status with Google recently but I'm scratching my head to think of exactly what IFFT is talking about in this post.
- aboutruby 8y agoMore info on the reddit threads: - Main one: https://www.reddit.com/r/ifttt/comments/b3umeo/gmail_is_being_removed_from_ifttt/ https://www.reddit.com/r/ifttt/comments/b3umeo/gmail_is_bein... - Alternatives: https://www.reddit.com/r/ifttt/comments/b3zv1z/alternative_to_gmail_applet_using_sheetsapp/ https://www.reddit.com/r/ifttt/comments/b3zv1z/alternative_t...
- runjake 8y agoApple's Shortcuts, too. Claiming that IFTTT and Apple Shortcuts have not complied with Google's privacy policy. That's rich.
- welder 8y agoGoing to really miss IFTTT... auto-responding using Gmail Filters and Canned Responses only works for a few hours before it stops auto-responding.
- deleted 8y ago[deleted]
- maxhedrome 8y agoJust wait til they shut down GAM
- tmp28342342 8y agoData privacy offers a good reason for both Google and Facebook to close the few gates that still offered access for 3rd party apps to their walled garden. And I don't think I can blame them. This kind of access provided very little benefits for them, but it has turned out to be a big PR problem.
- gerardnll 8y agoWhen you register an account in Facebook it tells you to connect your Google account to check for the confirmation email. There's no button that says 'no thanks', it kind of makes you think it's the only way to go forward. I don't want to know what kind of information they scoop out, but I guess, all that they can. It's incredible. But here, IFTTT is the problem... I'm pretty sure they don't care about your emails.
- arihant 8y agoI'm not sure how much user security will come out of the new Gmail policies. A lot of companies will just start asking for username/password for IMAP access. Now the user is more vulnerable than if the developer was allowed OAuth access. Unless they plan to break that somehow as well.
- qbaqbaqba 8y agoSo IMAP is the next on the kill list. RIP email.
- dazbradbury 8y agoSeems to be the same issue for Gmail backup tools, eg: https://github.com/jay0lee/got-your-back/issues/195 https://github.com/jay0lee/got-your-back/issues/195 Frustrating, given Google's own takeout tool doesn't work on larger inboxes! This is basically going to destroy the tools that were papering over gmails cracks.
- higfujk 8y agoGoogle reports straight to NSA cia anyways all messages. Do people listening at all what Snowden revealed ?