8 ms·
I tried to test it, but I literally don't feel comfortable giving somebody full access to my email. I don't know your practices, security protocols, etc. I'd f
by ddalex 8y ago
I tried to test it, but I literally don't feel comfortable giving somebody full access to my email. I don't know your practices, security protocols, etc.
I'd feel way more comfortable if this would be an app or a browser add-on that would handle everything locally, without sharing the access token with your servers.
- ymolodtsov 8y agoHow many emails clients do you know that don’t need access to your mail?
- amelius 8y agoDoes that matter? Why would you give, instead of just Google, two companies access to your emails?
- skybrian 8y agoWell, 2+N companies depending on what servers the people you correspond with use. That's the nature of a federated protocol.
- DarwinMailApp 8y agoHa ha. Very clever spin, and it's the truth!
- amelius 8y agoHowever ... the larger N, the weaker the argument. Because each of the participants has only a fraction of your e-mails.
- DarwinMailApp 8y agoThat is a fair point, amelius! However, I won't be giving any third parties access to DarwinMail ;)
- ddalex 8y agoThe better question here is: how many websites (with their own servers!) did you give full access to your email inbox? I didn't give it out to anybody else that Google. Google I trust implicitly because they host the server, so the email is already read by them before reaching the interface. Thunderbird stores email locally doesn't need to push it out. I wouldn't give Facebook ever access to my email account. Why should I give Darwin access AS A WEBSITE when it's not clear to me that they NEED to run their SERVER? If the interaction is done through JS entirely and the whole thing runs in the browser between me and Google, they can easily pack it as an extension.
- ymolodtsov 8y agoBecause there's no other way to properly implement instant push notifications for one thing. All modern email clients (like Spark, etc.) do that.
- DarwinMailApp 8y agoPart 1: I understand your worry. It's perfectly within the realm of reason. Please allow me to help alleviate your worries. The following are a list of the permissions DarwinMail requests of you. PS: WE NEVER store any email data that belongs to you. Google has verified our compliance via a lengthy audit! Manage mailbox labels — this allows DarwinMail to add and remove labels (inbox, snoozed, spam, etc) to your emails. Manage your sensitive mail settings — this allows DarwinMail to update settings such as your forwarding address and aliases. Manage you basic mail settings — this allows DarwinMail to update settings such as your signature and out of office reply. View and modify but not delete your email — this allows DarwinMail to create your email (when you use the compose functionality), modify you email, and send your email (when you click the send button). This also allows you to update and save drafts. Please feel free to check out the following official documentation from Google for further reading. https://developers.google.com/gmail/api/auth/scopes https://developers.google.com/gmail/api/auth/scopes
- ddalex 8y agoThanks for the pointers. I understand well how the OAuth scopes work. What I don't understand is - if the server doesn't handle my email, why does this need to be hosted on a server? Package it as a browser extension and this way I can be sure that my email is not leaked.
- DarwinMailApp 8y agoWow. This is an eye-opening comment. I like your point. It's fascinating. Right now, I need to look into the implications of running DarwinMail as a browser extension would be. To be sure your security would be maintained, the core functionality is not lost and DarwinMail remains usable (landing page with about, features, testimonials, pricing etc). Thank you for your suggestion!
- ddalex 8y agoSo the actual problem is that it seems to you you that one can't SELL a product as a browser extension. However Grammarly is a beautiful showcase of an actual product as an extension, with payment and everything you need (landing, testimonials, upsells, etc).
- DarwinMailApp 8y agoPart 2: DarwinMail is verified by Google! What does that mean? DarwinMail basically sits on top of Google's servers and displays the data in the same manner (and in time using the exact same features + more) as Inbox did. Darwin does not store any of your email data whatsoever. In fact, if it did, Google would have asked me to audit the tool - but they instead granted me Google verification. It took them almost a month to break down DarwinMail and make sure it did not store any user email data. If you have any questions on the verification process, please ask me! Or look here at the official Google documentation. https://twitter.com/joeytawadrous https://twitter.com/joeytawadrous https://support.google.com/cloud/answer/9110914 https://support.google.com/cloud/answer/9110914
- DarwinMailApp 8y agoPart 3: How does DarwimMail actually work? So what happens exactly is: The user logs into DarwinMail.app, DarwinMail makes a login request to Google's servers, Google logs the user in, DarwinMail asks for the users emails at which point this data is rendered in the user's browser. None of this email data is stored on DarwinMail's servers. There is no need! Think of all the space it would take up and the time that would be spent retrieving the data. Google's API & servers do the heavy lifting. DarwinMail allows you to view your emails just like Inbox, and hopefully provides (or will soon provide) the same kind of functionality :)
- teleclimber 8y agoIs your product open source? Because for this kind of thing it's really hard to trust unless it's open and self-hostable. Even if you say you don't need to store emails, there is still a chance of leaks via logging systems or simply programmer errors, or some caching layer. It's likely your security protocols aren't as robust as Google's. (You mention "https" as the primary reason this is secure. Much wow.) Given the importance of email there is no way I could trust another closed system with my email. I'm sorry if that sounds harsh, I also want to see alternative email frontends because gmail isn't cutting it.
- DarwinMailApp 8y agoIt's not open source at the moment no. You make a very good point, and I see where you are coming from. I personally have a hard time trusting other products with my data too. That's why I'm trying to be as transparent as possible with DarwinMail. If I were to make the product open source, would you consider using it then?
- teleclimber 8y agoYes, if you make it Open Source and possible to self-host it goes from DOA to definitely possible. Would have to explore more, like how it's written, the community around it, etc... before I really commit. Hopefully you can still make a living. I suspect "open source + commercially hosted" is a good model for something like this?