3 ms·

Saying that none of the "email data" is stored on your servers is a common way mail clients deflect from the real truth that people are interested in. Our email

by mdeeks 7y ago

Saying that none of the "email data" is stored on your servers is a common way mail clients deflect from the real truth that people are interested in. Our email data traverses through your servers and is stored in memory is it not? Additionally you have our access tokens correct? With those you have effective access to all of our email data. They are effectively a password. Worse actually since they bypass 2FA. If you leak those on accident or decide to use one from your home PC, you have access to all of our email data. The statement "None of this email data is stored on DarwinMail's servers" remains technically true, but does not address the real scope security issue most users are worried about. DarwinMail looks amazing and I'd love to use it, but until these questions above are answered or obviated via open-sourcing it, I don't think many users will be comfortable. My company admin policy explicitly denies your app for these reasons by the way: "Error: admin_policy_enforced Access to your account data is restricted by policies within your organization. Please contact administrator for more information."

DarwinMailApp 7y ago
Hello, and thank you for your comment and for explaining how you feel. What you have said is true but I'm not sure you fully understand how DarwinMail works. I hope to alleviate your concerns somewhat by explaining. DarwinMail does request and use your individual access tokens from Googles API servers in order to retrieve your emails. All the displaying is done on your browser. Any action you take for your emails is done on your browser. Any email you type and send it handled in your browser. Sure, DarwinMail is hosted on a server (Linode) but that's just to store the DarwinMail website on the internet so you can visit it. Even without open sourcing the code, you can still see all of the code that does the above managing of your emails in your own browser! Just right click -> Inspect -> Open up the sources tab and you can see it all! It's not hidden! In fact, search for Sarge's posts on this thread... that gentleman was looking through the code, reporting bugs to me and telling me how to fix them! Furthermore, Linode does not take security lightly and are trusted by many many companies and individuals. See for yourself: https://www.linode.com/security https://www.linode.com/security

by mdeeks 7y ago

DarwinMailApp 7y ago

Hello, and thank you for your comment and for explaining how you feel. What you have said is true but I'm not sure you fully understand how DarwinMail works. I hope to alleviate your concerns somewhat by explaining. DarwinMail does request and use your individual access tokens from Googles API servers in order to retrieve your emails. All the displaying is done on your browser. Any action you take for your emails is done on your browser. Any email you type and send it handled in your browser. Sure, DarwinMail is hosted on a server (Linode) but that's just to store the DarwinMail website on the internet so you can visit it. Even without open sourcing the code, you can still see all of the code that does the above managing of your emails in your own browser! Just right click -> Inspect -> Open up the sources tab and you can see it all! It's not hidden! In fact, search for Sarge's posts on this thread... that gentleman was looking through the code, reporting bugs to me and telling me how to fix them! Furthermore, Linode does not take security lightly and are trusted by many many companies and individuals. See for yourself: https://www.linode.com/security https://www.linode.com/security