13 ms·

Gmail’s API lockdown will kill some third-party app access, starting July 15

240 points by joeyh 7y ago

sct202 7y ago
As a former user of SMSBackup+, at a certain point it did seem like I was putting a lot of trust into a 3rd party to have full access to both my text messages and my email. So I can kind of see how it's a risk, but it seems sad to just shut it all down.
- tomswartz07 7y ago
  Current SMSBackup+ user here. I agree with your sentiment, but part of the key difference for me is that SMSBackup+ is open source. I've been building the app myself and using it for years, so I'm very certain what it's doing and not doing. This may or may not apply to the other apps being affected by this ban.
  - Qiasfah 7y ago
    Any good alternatives for this very useful app?
    - tomswartz07 7y ago
      Presently? None of which I'm aware. I'm very much hoping that we could resolve the issue with SMSBackup+ for the time being, but that's mostly up to the project owner. I did hear of some folks using their own IMAP server and CALDAV service to target instead of Google, but I have not tested it.
      - toomuchtodo 7y ago
        Sounds like a great use for Fastmail and their open JMAP protocol.
      - daturkel 7y ago
        I reached out to the author because I've been a user of the app for several years, but I haven't heard back (this was only a few days ago). I'm hoping it can continue in some form.
        fencepost 7y ago
        You're likely to have better luck monitoring the relevant issue on the github repo. https://github.com/jberkel/sms-backup-plus/issues/959 https://github.com/jberkel/sms-backup-plus/issues/959
      - nine_k 7y ago
        How about an app that just, well, sends the SMS texts to your email, as regular emails? A filtering rule would put them under a certain tag and skip inbox. The upside of the design is that it requires only one, very clear, permission: send emails to a given address.
        warmwaffles 7y ago
        SMSBackup+ makes the sender the contact / phone number and the receiver as your number. It's been fantastic for archiving all of my texts and such. I've been able to search it all relatively easily.
        londons_explore 7y ago
        It's less clear how to do a 'restore' with that model... Manually forward 10,000 messages to restore@smsbackup.com?
      - deleted 7y ago
        [deleted]
      - Reelin 7y ago
        I attempted to use SMS Gate (a fork) to do backups from the stock messaging app to the SD card. It didn't work. > I did hear of some folks using their own IMAP server ... I ended up syncing to a Dovecot IMAP server on my local Linux desktop, which seemed to work just fine. I was apprehensive about the complexity of setting an IMAP server up, but that turned out to be misguided - Dovecot was incredibly simple to get up and running. I assume SMSBackup+ would work just as well as SMS Gate did here. I eventually ended up moving from the stock messaging app to QKSMS (GPLv3, Github, Google Play, F-Droid) because it has built in backup functionality.
    - blackoil 7y ago
      MS has 'SMS Organizer'. It backups to Google Drive account. Though not sure if it is globally available.
  - tallanvor 7y ago
    If you have GSuite, it seems you can whitelist existing applications. I've done that with SMS Backup+, so it should keep working for me. At least that's my understanding. I suppose that people on the consumer side probably don't have that option, and it's probably not enough to get people to start paying.
    - Nexxxeh 7y ago
      I already pay Google as a One customer. Does GSuite have a (possibly not presently enforced) five user minimum?
- pmlnr 7y ago
  SMSBackup+ works perfectly fine with IMAP backends.
deleted 7y ago
[deleted]
SpicyLemonZest 7y ago
> Google's OAuth APIs have been around for years as a way for apps to get access to and control your Google data. A third-party email app, for instance, would want access to your Gmail account and the ability to send, read, and delete emails so it could control everything remotely. An IM app might just want access to your contacts and profile picture. For years this was purely an agreement between the user and the developer—the app would say what it wanted access to, and the user could deny or allow it. Yeah, until the Cambridge Analytica scandal revealed that agreements like this aren't sufficient to protect user data. I think Google's making the only acceptable tradeoff here.
- mhandley 7y ago
  And for European users under GDPR, maybe the only legal tradeoff too.
  - anoncake 7y ago
    What makes you think that the GDPR, which is designed to give users control over their data, makes it illegal to give users control over their data?
    - mhandley 7y ago
      Under GDPR, Google can only use your data for the uses you have given permission for. This includes not handing it to other companies (via their API or otherwise) for any other uses.
      - TeMPOraL 7y ago
        All they'd need to do is give me a way to grant them permission to share this data, and add that other company to their who-we-share-with list for my account. (Also I guess they're already doing that, because the API isn't being killed off, it's being restricted to companies that threw a couple dozen kilodollars into a Google-approved bonfire.)
- quotemstr 7y ago
tomswartz07 7y ago
I see this as a double-edged sword. 1. It makes sense that Google wants to stop apps from abusing their storage platform. There are a lot of projects that abuse the data storage capacity. There was that one app that converted files to Base64 or something and was storing files that way as email text. Obviously not cool. However, Google needs to be explicitly clear on expectations and throw some people-power behind the reviews, since many are being denied by (seemingly) some automated process. 2. The second issue I see is that it will encourage less secure methods of using these apps. SMSBackup+ in particular is discussing the possibility of moving to "App Passwords" to bypass 2FA and provide the app access it needs to upload and store the data. Issue being, App Passwords are incredibly fragile, they provide near-unfettered access to IMAP and other account features with no auditing. Caveat emptor and all that. I think SMSBackup+, specifically, has a bit of a gray line as SMS messages can technically be sent via email and vice versa, (among other similarities). It's a shame that Google is becoming so draconian about their data storage uses.
- deleted 7y ago
  [deleted]
- lordpankake 7y ago
  I doubt this has anything to do with my Unlimited Drive storage thing. Google are doing this to stop API consumers from storing user data on their own, presumably less safe than Google's, servers. I agree with that decision completely.
  - nine_k 7y ago
    Just read it again. To me, it reads like this: Google is going to prevent users from storing users' data elsewhere. As if it's Google's data, not users'. Though with the free tier this as well may in fact be the case :-/
    - nicholosophy 7y ago
      There's that aspect. I also imagine there is the other side where the third party has crap data security. End users figure that their data is safe with Google and may not consider that there is a third party with their various levels of security. I can see Google copping a lot of heat should Company X have a data leak and that data was originally gathered from a users Google data store, whether it is justified or not.
lstodd 7y ago
> "Don't store Google user data on your server." The, I'm sorry, WTF? This is not Google's data.
- cameronbrown 7y ago
  Google _user_ data. And it's certainly not your data either, if you're storing it on your own servers.
  - lukeschlather 7y ago
    Google seems to be casting a very wide net. In the case of the SMS Backup+ app which is open source and doesn't operate servers, it does sound like Google is essentially telling people not to store their personal data. (It's an open source app that downloads/uploads things from your phone.)
- brongondwana 7y ago
  Yeah, totally. It's our customer's data, who is also Google's customer. Obviously since Fastmail allows our customers to synchronise email and calendars with Google, we're dealing with this right now - and kind of annoyed that our customers got emailed when we were already following Google's reauthentication process. Fun times.
  - dboreham 7y ago
    Any progress with this? Also is it true that GSuite (paid) accounts are not affected?
    - brongondwana 7y ago
      It's still underway. I'm afraid I have no idea about GSuite accounts, you'd have to ask somebody who knows Google's policies.
- jsnell 7y ago
  That appears to be a phrase made up by the writer of the Ars Technica article, rather than a quote. It's probably not worth getting outraged over the exact phrasing, it's just sloppy writing from a third party.
paxys 7y ago
There will always be misuse of open APIs by third parties, and the company itself will be blamed in the PR fallout. After Google and Facebook I expect more services to follow suit, which is a shame but understandable.
quotemstr 7y ago
I wonder how long it'll take for scraping to make a comeback. I feel like we've become used to APIs being the only integration options. When API restrictions become too burdensome, however, I expect people to recall that other access options exist.
- johnwheeler 7y ago
  Funny thing - there’s a very successful bank account aggregation API company called Yodlee that gets the majority of it’s bank data through scraping your account given that account’s username and password.
- londons_explore 7y ago
  Google webservices make scraping pretty easy. They send all data back in a rest-like API, protobuf encoded. All you need to do is guess the protobuf schema. Since protobuf is backwards compatible, you can be fairly sure your scraping won't break arbitrary either. In many cases, they send back more data than is shown in the webUI too.
alacombe 7y ago
So... if every player (and Google in particular) start locking their platform, how could this not constitute ground for antitrust trial ? Even explorer was less tightly integrated 25 years ago...
xt508 7y ago
I just noticed a new "Schedule Send" Gmail feature, could this be related and Google is adding in features from third-party apps?
akkartik 7y ago
I've been expecting this. Google's attempts to get me to turn off "less secure app access" have grown increasingly obnoxious over the last couple of years. A few months ago they went so far as to send me a "prevented login from suspicious device" alert after a getmail run. Time to leave. If I can't download it with POP or IMAP, then it's not email.
- rjf72 7y ago
  Out of curiosity do you ever login to your Google account on the web? I also had the exact same experience where they have started increasingly sending alarming, and fake, security notices about suspicious devices logging in. Those device are, of course, me logging in from an identical geomapped IP using IMAP as I've done for years. This was following their decision to require IMAP access to require the "allow insecure application access" as an encrypted IMAP connection is apparently insecure now. A couple of times they also reset the "allow insecure application access" toggle on my account. My working theory is that they were simply trying to refresh their fingerprint on my account since the only point of these alerts seems to be to get me to login using their web page. In particular I use Google for IMAP email, but never login to my Google account until forced. That's not so great for their metadata and tracking. Interestingly enough then when I then do login using a proxy half a world away from where I use my IMAP, Google never considers it a "login from a suspicious device." And yeah, as annoying as it is to migrate my primary email - Google is becoming intolerable on so many levels.
  - akkartik 7y ago
    I currently use the regular Gmail UI as my MUA. Getmail is just an offline backup.
  - londons_explore 7y ago
    I see the same. About once a year, Google will throw a hissy about someone logging on via IMAP/SMTP, even if it is Google themselves logging in (to send email as another account). My guess is if some fingerprinting/Auth service is down, it fails in a 'safe' state, causing the login to be rejected and your account locked.
_Codemonkeyism 7y ago
The email client I use - Nine - is on the list. I can't see how an email client is a problem except they want to push Googles client. Hope Nine gets fixed.
- Cu3PO42 7y ago
  I sincerely hope so as well. I'm just at the end of the trial period and I'll likely take the plunge, but not having access to Gmail would be very inconvenient. They say they'll fix it, but seeing the requirements I'm not sure they'll get it done in time.
- fencepost 7y ago
  Huh, Nine does Gmail? Guess that makes sense. I've just been using it because I have 3 different Exchange accounts I need connections to and it's quite nice for that.
jackjackk0 7y ago
The only third-party app I received a warning about from Google regarding this issue was FastMail... coincidence?
dpacmittal 7y ago
Slightly off topic, but Google is also discontinuing Google photos and google drive syncing feature. This is currently the only way to access your Google photos with Rclone.
- pmlnr 7y ago
  Wait, that's... that's actually bad, unlike Gmail. Drive _is_ a storage endpoint, so is Photos. Not having a way to sync them is a serious issue.
  - dpacmittal 7y ago
    Yeah. It's ending on July 10 - https://www.blog.google/products/photos/simplifying-google-photos-and-google-drive/ https://www.blog.google/products/photos/simplifying-google-p...
    - yrro 7y ago
      To be fair I can't blame them for this--the feature is confusing (I'm pretty sure it's responsible for every photo in my account up to a point in time last year being duplicated [in a rather annoying way--they appear visually identical and have the same EXIF tags and timestamps, but are different sizes, as a result my obsessive compulsive tendency won't let me delete either]). I presume you can still download all your photos via Google Takeout right?
      - pmlnr 7y ago
        I do blame them. Google Photos should have been a frontend for Drive from the beginning. Splitting it into another storage is wrong.
        ilikehurdles 7y ago
        Google wants the ability to promise unlimited storage without any of the responsibility of meeting that promise.
unixhero 7y ago
Christ. So much for the API economy.
bjourne 7y ago
This is really shit. Fuck Google. First they offer services on good terms to attract lots of users to their platform. Then when they have enough users for network effects to take over they change their terms to keep competitors out.
- chii 7y ago
  So whose fault is it? Google for bait and swich? Or the users who fall for it?
  - BentFranklin 7y ago
    Google, obvs.
prasanthmj 7y ago
I invested a lot of time trying to publish a Gmail add-on and failed miserably [1][4] because of this lockdown. Here are some notes that may be of interest: The lock down is for the Gmail API especially for API that allows reading user’s email. Any App has to get OAuth 2 token to get access to the API. The user has to explicitly provide access . The approval screen will show each type of access the app is asking. See an example here [2] In addition, Google will send an email to the user immediately after the approval, with a scary warning. The user can withdraw the app access anytime, from Google account page. The data access concern Google is projecting is that the APP can read user’s email (Remember, the app can read only those who explicitly gave the app the permission to read their email). The “lockdown” is a direct reply to the media frenzy that “Gmail allows any app to read anyone's email” [5]. Gmail does not allow reading email automatically. The user has to allow explicitly. In order to get Gmail API access, the app has to go through a Google review process where Google will ask the developer to justify each type of API access the app is requesting in addition to explaining (with videos) what the app does and how the API is used. The first level of approval process demands you to publish a comprehensive privacy policy and in my experience, anything like “marketing” or “research” in the privacy policy will get you disapproval. [3] Such a strict approval process is good and fine, and well appreciated till this point. The issue comes for the last part of the approval process. Those Apps that requires read access to Gmail has to get themselves assessed, through Google appointed third party security assessors paying $75000 USD annually. This is the main blocker. This will kick out any app or add-on that small scale developers create. It will block new entrants. What remains will be established apps that are generating huge revenue to justify the “protection money”. They get an added advantage that there will no longer be any new competition. It is not the restrictions, or the intention to protect the end user that is in question but the “first save my back” attitude in the process, and the bait and switch - that is the problem. In summary it happened like this: Hey developers come, build apps using our platform, show your innovation! Developers start investing time and effort on the platform, approval process is smooth and fare Somewhere else, someone misuses someone’s system, huge media attention Sorry developers, you go to Mr X , keep paying him and we will keep you here. If not, trash your product and go away. [1] https://medium.com/@prasanthmj/lessons-learned-developing-an-app-using-google-apis-dff3f7b91be0 https://medium.com/@prasanthmj/lessons-learned-developing-an... [2] https://www.youtube.com/watch?v=GGXFQUmZTf4 https://www.youtube.com/watch?v=GGXFQUmZTf4 [3] https://blog.gsmart.in/applying-for-g-suite-api-approvals/ https://blog.gsmart.in/applying-for-g-suite-api-approvals/ [4] https://medium.com/@prasanthmj/google-restricted-api-scopes-require-75k-yearly-fees-a23cad053a4c https://medium.com/@prasanthmj/google-restricted-api-scopes-... [5] https://www.wsj.com/articles/techs-dirty-secret-the-app-developers-sifting-through-your-gmail-1530544442 https://www.wsj.com/articles/techs-dirty-secret-the-app-deve...
pmlnr 7y ago
Good. Maybe email clients will go back being email clients with IMAP so they can be used with _any_ provider, not just gmail.
miki123211 7y ago
how long until Google says "hey, actually, it would be cool if users used gmail.com with all the ads instead of some stupid external email clients. Let's disable POP3/IMAP/SMTP for non-business users. Oh, and let's disallow mail redirection too, so they won't even think about running away".
- m-p-3 7y ago
  This will be the day I change my personal email address permanently. If they're not only satisfied at data-mining my email, then screw it.
- BentFranklin 7y ago
  That's where I think this is headed. The old model of them mining your emails just wasn't good enough for them.
- repolfx 7y ago
  Gmail doesn't have ads in it anymore.
  - smilliken 7y ago
    I thought so too, but I saw text ads in someone else's inbox this week.
  - smitop 7y ago
    Both the app and the website have ads, I just checked. They look like normal email messages, but they start with an advertisement indicator. I only see them in the "Promotions" and "Social" tab though.
dazbradbury 7y ago
Does anyone know if this will have any impact on Gmail backup tools such as: https://github.com/jay0lee/got-your-back https://github.com/jay0lee/got-your-back Or the long term sustainability of such projects? I've found gmail's own data export tools to not work at all for any inbox of a considerable size (100gb+) - so third party tools are the only way to actually back up / migrate email data. Without such tooling, relying on Gmail would be a huge mistake for anything remotely important.
- aepiepaey 7y ago
  It requires the user to create their own API project. GYB has such functionality built-in since 1.20, see the release notes: https://github.com/jay0lee/got-your-back/releases/tag/v1.20 https://github.com/jay0lee/got-your-back/releases/tag/v1.20 For gmvault, you have to create it manually: https://github.com/gaubert/gmvault/issues/335#issuecomment-475437988 https://github.com/gaubert/gmvault/issues/335#issuecomment-4...
exabrial 7y ago
Yep, I wish I could opt out. For years, I've used an app to backup my sms messages to gmail, now it's being taken away.
- aqzman 7y ago
  SMS Backup+? I totally agree, I wish I could opt out as well. Having my text messages and phone call log backed up to Gmail with this app has come in handy so many times since I started using it in 2012.
  - giarc 7y ago
    Just thinking out loud but could IFTTT accomplish something like this without integration into Gmail?
laurent123456 7y ago
The article mentions this is going to affect Drive soon too, but couldn't find any info about this on Google announcement. Anybody has any info on this?
- kwerk 7y ago
  Looks like[0] using the scopes that allow for seeing all drive files vs specific files the user has invoked your app to see triggers the review process next year. [0] https://cloud.google.com/blog/products/identity-security/enhancing-security-controls-for-google-drive-third-party-apps/ https://cloud.google.com/blog/products/identity-security/enh...
Zenbit_UX 7y ago
This doesn't bode well for companies like streak whose sole product is an add-on to Gmail...
- giarc 7y ago
  Gmass owner has talked about this changed in a few blog posts. For companies that are built on Gmail, they will just have to pay the $15k-75k security audit fee and consider it cost of doing business.
js4ever 7y ago
I'm now considering to stop using gmail and all google services in general
ryanmercer 7y ago
The changes they've been doing is somewhat annoying. It killed probably 75% of my IFTTT and now it is going to kill my SMS backup solution (SMSBackup+) unless the developer changes a bunch of stuff. Sure I can backup other ways but I like having it in my gmail, I've been saving SMS backup there since the iPhone 3gs. I get why they are doing it but blah, now I have to find solutions for everything again.
6cd6beb 7y ago
You shouldn't be building anything that relies on a google service unless A) Google would die without that service B) You're just fucking around and what your building could burn to the ground without consequence https://killedbygoogle.com/ https://killedbygoogle.com/ has 143 services listed.
- la_barba 7y ago
  To add a few.. C) You're looking to get acquired by Google C) a) You're looking to get noticed and hired by Google
jguimont 7y ago
They could have gone another route than imposing a bogus security audit and have the devs pay for it. I did an integration with QuickBooks a while back, and they paid/conducted the security audit themselves. Google could have added a contract that would plainly state that any data needs to be wiped out etc and enforce that contract if anything is fishy. Google could have created a process to clearly inform the dev that the user wants to delete google related data and impose deadlines on it. Those are simple, but I think Google was just lazy and listened to a bunch of lawyers instead of thinking out the box. I have an app that allows to link your email account thru Nylas (with google), now I would have to pay the security audit? No way. I told my customers that any google account that is not a GSuite which whitelisted the app (most of my customers corporate) that they might have warning dialog when connecting their gmail account. There is a limit of 100 linked account without verification ;(
tregoning 7y ago
Doesn't this mean that SuperHuman is screwed?

240 points by joeyh 7y ago

As a former user of SMSBackup+, at a certain point it did seem like I was putting a lot of trust into a 3rd party to have full access to both my text messages and my email. So I can kind of see how it's a risk, but it seems sad to just shut it all down.

tomswartz07 7y ago
Current SMSBackup+ user here. I agree with your sentiment, but part of the key difference for me is that SMSBackup+ is open source. I've been building the app myself and using it for years, so I'm very certain what it's doing and not doing. This may or may not apply to the other apps being affected by this ban.
- Qiasfah 7y ago
  Any good alternatives for this very useful app?
  - tomswartz07 7y ago
    Presently? None of which I'm aware. I'm very much hoping that we could resolve the issue with SMSBackup+ for the time being, but that's mostly up to the project owner. I did hear of some folks using their own IMAP server and CALDAV service to target instead of Google, but I have not tested it.
    - toomuchtodo 7y ago
      Sounds like a great use for Fastmail and their open JMAP protocol.
    - daturkel 7y ago
      I reached out to the author because I've been a user of the app for several years, but I haven't heard back (this was only a few days ago). I'm hoping it can continue in some form.
      - fencepost 7y ago
        You're likely to have better luck monitoring the relevant issue on the github repo. https://github.com/jberkel/sms-backup-plus/issues/959 https://github.com/jberkel/sms-backup-plus/issues/959
    - nine_k 7y ago
      How about an app that just, well, sends the SMS texts to your email, as regular emails? A filtering rule would put them under a certain tag and skip inbox. The upside of the design is that it requires only one, very clear, permission: send emails to a given address.
      - warmwaffles 7y ago
        SMSBackup+ makes the sender the contact / phone number and the receiver as your number. It's been fantastic for archiving all of my texts and such. I've been able to search it all relatively easily.
      - londons_explore 7y ago
        It's less clear how to do a 'restore' with that model... Manually forward 10,000 messages to restore@smsbackup.com?
    - deleted 7y ago
      [deleted]
    - Reelin 7y ago
      I attempted to use SMS Gate (a fork) to do backups from the stock messaging app to the SD card. It didn't work. > I did hear of some folks using their own IMAP server ... I ended up syncing to a Dovecot IMAP server on my local Linux desktop, which seemed to work just fine. I was apprehensive about the complexity of setting an IMAP server up, but that turned out to be misguided - Dovecot was incredibly simple to get up and running. I assume SMSBackup+ would work just as well as SMS Gate did here. I eventually ended up moving from the stock messaging app to QKSMS (GPLv3, Github, Google Play, F-Droid) because it has built in backup functionality.
  - blackoil 7y ago
    MS has 'SMS Organizer'. It backups to Google Drive account. Though not sure if it is globally available.
- tallanvor 7y ago
  If you have GSuite, it seems you can whitelist existing applications. I've done that with SMS Backup+, so it should keep working for me. At least that's my understanding. I suppose that people on the consumer side probably don't have that option, and it's probably not enough to get people to start paying.
  - Nexxxeh 7y ago
    I already pay Google as a One customer. Does GSuite have a (possibly not presently enforced) five user minimum?
pmlnr 7y ago
SMSBackup+ works perfectly fine with IMAP backends.

deleted 7y ago

[deleted]

SpicyLemonZest 7y ago

> Google's OAuth APIs have been around for years as a way for apps to get access to and control your Google data. A third-party email app, for instance, would want access to your Gmail account and the ability to send, read, and delete emails so it could control everything remotely. An IM app might just want access to your contacts and profile picture. For years this was purely an agreement between the user and the developer—the app would say what it wanted access to, and the user could deny or allow it. Yeah, until the Cambridge Analytica scandal revealed that agreements like this aren't sufficient to protect user data. I think Google's making the only acceptable tradeoff here.

mhandley 7y ago
And for European users under GDPR, maybe the only legal tradeoff too.
- anoncake 7y ago
  What makes you think that the GDPR, which is designed to give users control over their data, makes it illegal to give users control over their data?
  - mhandley 7y ago
    Under GDPR, Google can only use your data for the uses you have given permission for. This includes not handing it to other companies (via their API or otherwise) for any other uses.
    - TeMPOraL 7y ago
      All they'd need to do is give me a way to grant them permission to share this data, and add that other company to their who-we-share-with list for my account. (Also I guess they're already doing that, because the API isn't being killed off, it's being restricted to companies that threw a couple dozen kilodollars into a Google-approved bonfire.)
quotemstr 7y ago

tomswartz07 7y ago

I see this as a double-edged sword. 1. It makes sense that Google wants to stop apps from abusing their storage platform. There are a lot of projects that abuse the data storage capacity. There was that one app that converted files to Base64 or something and was storing files that way as email text. Obviously not cool. However, Google needs to be explicitly clear on expectations and throw some people-power behind the reviews, since many are being denied by (seemingly) some automated process. 2. The second issue I see is that it will encourage less secure methods of using these apps. SMSBackup+ in particular is discussing the possibility of moving to "App Passwords" to bypass 2FA and provide the app access it needs to upload and store the data. Issue being, App Passwords are incredibly fragile, they provide near-unfettered access to IMAP and other account features with no auditing. Caveat emptor and all that. I think SMSBackup+, specifically, has a bit of a gray line as SMS messages can technically be sent via email and vice versa, (among other similarities). It's a shame that Google is becoming so draconian about their data storage uses.

deleted 7y ago
[deleted]
lordpankake 7y ago
I doubt this has anything to do with my Unlimited Drive storage thing. Google are doing this to stop API consumers from storing user data on their own, presumably less safe than Google's, servers. I agree with that decision completely.
- nine_k 7y ago
  Just read it again. To me, it reads like this: Google is going to prevent users from storing users' data elsewhere. As if it's Google's data, not users'. Though with the free tier this as well may in fact be the case :-/
  - nicholosophy 7y ago
    There's that aspect. I also imagine there is the other side where the third party has crap data security. End users figure that their data is safe with Google and may not consider that there is a third party with their various levels of security. I can see Google copping a lot of heat should Company X have a data leak and that data was originally gathered from a users Google data store, whether it is justified or not.

lstodd 7y ago

> "Don't store Google user data on your server." The, I'm sorry, WTF? This is not Google's data.

cameronbrown 7y ago
Google _user_ data. And it's certainly not your data either, if you're storing it on your own servers.
- lukeschlather 7y ago
  Google seems to be casting a very wide net. In the case of the SMS Backup+ app which is open source and doesn't operate servers, it does sound like Google is essentially telling people not to store their personal data. (It's an open source app that downloads/uploads things from your phone.)
brongondwana 7y ago
Yeah, totally. It's our customer's data, who is also Google's customer. Obviously since Fastmail allows our customers to synchronise email and calendars with Google, we're dealing with this right now - and kind of annoyed that our customers got emailed when we were already following Google's reauthentication process. Fun times.
- dboreham 7y ago
  Any progress with this? Also is it true that GSuite (paid) accounts are not affected?
  - brongondwana 7y ago
    It's still underway. I'm afraid I have no idea about GSuite accounts, you'd have to ask somebody who knows Google's policies.
jsnell 7y ago
That appears to be a phrase made up by the writer of the Ars Technica article, rather than a quote. It's probably not worth getting outraged over the exact phrasing, it's just sloppy writing from a third party.

paxys 7y ago

There will always be misuse of open APIs by third parties, and the company itself will be blamed in the PR fallout. After Google and Facebook I expect more services to follow suit, which is a shame but understandable.

quotemstr 7y ago

I wonder how long it'll take for scraping to make a comeback. I feel like we've become used to APIs being the only integration options. When API restrictions become too burdensome, however, I expect people to recall that other access options exist.

johnwheeler 7y ago
Funny thing - there’s a very successful bank account aggregation API company called Yodlee that gets the majority of it’s bank data through scraping your account given that account’s username and password.
londons_explore 7y ago
Google webservices make scraping pretty easy. They send all data back in a rest-like API, protobuf encoded. All you need to do is guess the protobuf schema. Since protobuf is backwards compatible, you can be fairly sure your scraping won't break arbitrary either. In many cases, they send back more data than is shown in the webUI too.

alacombe 7y ago

So... if every player (and Google in particular) start locking their platform, how could this not constitute ground for antitrust trial ? Even explorer was less tightly integrated 25 years ago...

xt508 7y ago

I just noticed a new "Schedule Send" Gmail feature, could this be related and Google is adding in features from third-party apps?

akkartik 7y ago

I've been expecting this. Google's attempts to get me to turn off "less secure app access" have grown increasingly obnoxious over the last couple of years. A few months ago they went so far as to send me a "prevented login from suspicious device" alert after a getmail run. Time to leave. If I can't download it with POP or IMAP, then it's not email.

rjf72 7y ago
Out of curiosity do you ever login to your Google account on the web? I also had the exact same experience where they have started increasingly sending alarming, and fake, security notices about suspicious devices logging in. Those device are, of course, me logging in from an identical geomapped IP using IMAP as I've done for years. This was following their decision to require IMAP access to require the "allow insecure application access" as an encrypted IMAP connection is apparently insecure now. A couple of times they also reset the "allow insecure application access" toggle on my account. My working theory is that they were simply trying to refresh their fingerprint on my account since the only point of these alerts seems to be to get me to login using their web page. In particular I use Google for IMAP email, but never login to my Google account until forced. That's not so great for their metadata and tracking. Interestingly enough then when I then do login using a proxy half a world away from where I use my IMAP, Google never considers it a "login from a suspicious device." And yeah, as annoying as it is to migrate my primary email - Google is becoming intolerable on so many levels.
- akkartik 7y ago
  I currently use the regular Gmail UI as my MUA. Getmail is just an offline backup.
- londons_explore 7y ago
  I see the same. About once a year, Google will throw a hissy about someone logging on via IMAP/SMTP, even if it is Google themselves logging in (to send email as another account). My guess is if some fingerprinting/Auth service is down, it fails in a 'safe' state, causing the login to be rejected and your account locked.

_Codemonkeyism 7y ago

The email client I use - Nine - is on the list. I can't see how an email client is a problem except they want to push Googles client. Hope Nine gets fixed.

Cu3PO42 7y ago
I sincerely hope so as well. I'm just at the end of the trial period and I'll likely take the plunge, but not having access to Gmail would be very inconvenient. They say they'll fix it, but seeing the requirements I'm not sure they'll get it done in time.
fencepost 7y ago
Huh, Nine does Gmail? Guess that makes sense. I've just been using it because I have 3 different Exchange accounts I need connections to and it's quite nice for that.

jackjackk0 7y ago

The only third-party app I received a warning about from Google regarding this issue was FastMail... coincidence?

dpacmittal 7y ago

Slightly off topic, but Google is also discontinuing Google photos and google drive syncing feature. This is currently the only way to access your Google photos with Rclone.

pmlnr 7y ago
Wait, that's... that's actually bad, unlike Gmail. Drive _is_ a storage endpoint, so is Photos. Not having a way to sync them is a serious issue.
- dpacmittal 7y ago
  Yeah. It's ending on July 10 - https://www.blog.google/products/photos/simplifying-google-photos-and-google-drive/ https://www.blog.google/products/photos/simplifying-google-p...
  - yrro 7y ago
    To be fair I can't blame them for this--the feature is confusing (I'm pretty sure it's responsible for every photo in my account up to a point in time last year being duplicated [in a rather annoying way--they appear visually identical and have the same EXIF tags and timestamps, but are different sizes, as a result my obsessive compulsive tendency won't let me delete either]). I presume you can still download all your photos via Google Takeout right?
    - pmlnr 7y ago
      I do blame them. Google Photos should have been a frontend for Drive from the beginning. Splitting it into another storage is wrong.
      - ilikehurdles 7y ago
        Google wants the ability to promise unlimited storage without any of the responsibility of meeting that promise.

unixhero 7y ago

Christ. So much for the API economy.

bjourne 7y ago

This is really shit. Fuck Google. First they offer services on good terms to attract lots of users to their platform. Then when they have enough users for network effects to take over they change their terms to keep competitors out.

chii 7y ago
So whose fault is it? Google for bait and swich? Or the users who fall for it?
- BentFranklin 7y ago
  Google, obvs.

prasanthmj 7y ago

I invested a lot of time trying to publish a Gmail add-on and failed miserably [1][4] because of this lockdown. Here are some notes that may be of interest: The lock down is for the Gmail API especially for API that allows reading user’s email. Any App has to get OAuth 2 token to get access to the API. The user has to explicitly provide access . The approval screen will show each type of access the app is asking. See an example here [2] In addition, Google will send an email to the user immediately after the approval, with a scary warning. The user can withdraw the app access anytime, from Google account page. The data access concern Google is projecting is that the APP can read user’s email (Remember, the app can read only those who explicitly gave the app the permission to read their email). The “lockdown” is a direct reply to the media frenzy that “Gmail allows any app to read anyone's email” [5]. Gmail does not allow reading email automatically. The user has to allow explicitly. In order to get Gmail API access, the app has to go through a Google review process where Google will ask the developer to justify each type of API access the app is requesting in addition to explaining (with videos) what the app does and how the API is used. The first level of approval process demands you to publish a comprehensive privacy policy and in my experience, anything like “marketing” or “research” in the privacy policy will get you disapproval. [3] Such a strict approval process is good and fine, and well appreciated till this point. The issue comes for the last part of the approval process. Those Apps that requires read access to Gmail has to get themselves assessed, through Google appointed third party security assessors paying $75000 USD annually. This is the main blocker. This will kick out any app or add-on that small scale developers create. It will block new entrants. What remains will be established apps that are generating huge revenue to justify the “protection money”. They get an added advantage that there will no longer be any new competition. It is not the restrictions, or the intention to protect the end user that is in question but the “first save my back” attitude in the process, and the bait and switch - that is the problem. In summary it happened like this: Hey developers come, build apps using our platform, show your innovation! Developers start investing time and effort on the platform, approval process is smooth and fare Somewhere else, someone misuses someone’s system, huge media attention Sorry developers, you go to Mr X , keep paying him and we will keep you here. If not, trash your product and go away. [1] https://medium.com/@prasanthmj/lessons-learned-developing-an-app-using-google-apis-dff3f7b91be0 https://medium.com/@prasanthmj/lessons-learned-developing-an... [2] https://www.youtube.com/watch?v=GGXFQUmZTf4 https://www.youtube.com/watch?v=GGXFQUmZTf4 [3] https://blog.gsmart.in/applying-for-g-suite-api-approvals/ https://blog.gsmart.in/applying-for-g-suite-api-approvals/ [4] https://medium.com/@prasanthmj/google-restricted-api-scopes-require-75k-yearly-fees-a23cad053a4c https://medium.com/@prasanthmj/google-restricted-api-scopes-... [5] https://www.wsj.com/articles/techs-dirty-secret-the-app-developers-sifting-through-your-gmail-1530544442 https://www.wsj.com/articles/techs-dirty-secret-the-app-deve...

pmlnr 7y ago

Good. Maybe email clients will go back being email clients with IMAP so they can be used with _any_ provider, not just gmail.

miki123211 7y ago

how long until Google says "hey, actually, it would be cool if users used gmail.com with all the ads instead of some stupid external email clients. Let's disable POP3/IMAP/SMTP for non-business users. Oh, and let's disallow mail redirection too, so they won't even think about running away".

m-p-3 7y ago
This will be the day I change my personal email address permanently. If they're not only satisfied at data-mining my email, then screw it.
BentFranklin 7y ago
That's where I think this is headed. The old model of them mining your emails just wasn't good enough for them.
repolfx 7y ago
Gmail doesn't have ads in it anymore.
- smilliken 7y ago
  I thought so too, but I saw text ads in someone else's inbox this week.
- smitop 7y ago
  Both the app and the website have ads, I just checked. They look like normal email messages, but they start with an advertisement indicator. I only see them in the "Promotions" and "Social" tab though.

dazbradbury 7y ago

Does anyone know if this will have any impact on Gmail backup tools such as: https://github.com/jay0lee/got-your-back https://github.com/jay0lee/got-your-back Or the long term sustainability of such projects? I've found gmail's own data export tools to not work at all for any inbox of a considerable size (100gb+) - so third party tools are the only way to actually back up / migrate email data. Without such tooling, relying on Gmail would be a huge mistake for anything remotely important.

aepiepaey 7y ago
It requires the user to create their own API project. GYB has such functionality built-in since 1.20, see the release notes: https://github.com/jay0lee/got-your-back/releases/tag/v1.20 https://github.com/jay0lee/got-your-back/releases/tag/v1.20 For gmvault, you have to create it manually: https://github.com/gaubert/gmvault/issues/335#issuecomment-475437988 https://github.com/gaubert/gmvault/issues/335#issuecomment-4...

exabrial 7y ago

Yep, I wish I could opt out. For years, I've used an app to backup my sms messages to gmail, now it's being taken away.

aqzman 7y ago
SMS Backup+? I totally agree, I wish I could opt out as well. Having my text messages and phone call log backed up to Gmail with this app has come in handy so many times since I started using it in 2012.
- giarc 7y ago
  Just thinking out loud but could IFTTT accomplish something like this without integration into Gmail?

laurent123456 7y ago

The article mentions this is going to affect Drive soon too, but couldn't find any info about this on Google announcement. Anybody has any info on this?

kwerk 7y ago
Looks like[0] using the scopes that allow for seeing all drive files vs specific files the user has invoked your app to see triggers the review process next year. [0] https://cloud.google.com/blog/products/identity-security/enhancing-security-controls-for-google-drive-third-party-apps/ https://cloud.google.com/blog/products/identity-security/enh...

Zenbit_UX 7y ago

This doesn't bode well for companies like streak whose sole product is an add-on to Gmail...

giarc 7y ago
Gmass owner has talked about this changed in a few blog posts. For companies that are built on Gmail, they will just have to pay the $15k-75k security audit fee and consider it cost of doing business.

js4ever 7y ago

I'm now considering to stop using gmail and all google services in general

ryanmercer 7y ago

The changes they've been doing is somewhat annoying. It killed probably 75% of my IFTTT and now it is going to kill my SMS backup solution (SMSBackup+) unless the developer changes a bunch of stuff. Sure I can backup other ways but I like having it in my gmail, I've been saving SMS backup there since the iPhone 3gs. I get why they are doing it but blah, now I have to find solutions for everything again.

6cd6beb 7y ago

You shouldn't be building anything that relies on a google service unless A) Google would die without that service B) You're just fucking around and what your building could burn to the ground without consequence https://killedbygoogle.com/ https://killedbygoogle.com/ has 143 services listed.

la_barba 7y ago
To add a few.. C) You're looking to get acquired by Google C) a) You're looking to get noticed and hired by Google

jguimont 7y ago

They could have gone another route than imposing a bogus security audit and have the devs pay for it. I did an integration with QuickBooks a while back, and they paid/conducted the security audit themselves. Google could have added a contract that would plainly state that any data needs to be wiped out etc and enforce that contract if anything is fishy. Google could have created a process to clearly inform the dev that the user wants to delete google related data and impose deadlines on it. Those are simple, but I think Google was just lazy and listened to a bunch of lawyers instead of thinking out the box. I have an app that allows to link your email account thru Nylas (with google), now I would have to pay the security audit? No way. I told my customers that any google account that is not a GSuite which whitelisted the app (most of my customers corporate) that they might have warning dialog when connecting their gmail account. There is a limit of 100 linked account without verification ;(

tregoning 7y ago

Doesn't this mean that SuperHuman is screwed?