5 ms·
Tell HN: Google halts Gmail and Drive apps and forces them to do security audits
I found our Google App's OAuth permissions were decertified today after seeing some users receiving permissions errors. Google did this without so much as an email to us. Upon digging in further, I discovered that they changed their policy on February 7th, effectively revoking our existing app permissions, and requiring anyone requesting those permissions go through a 3rd party security audit (3P) at the cost of (in their estimation) $15,000 to $75,000 before getting permissions back. They also state this process will take 4-6 weeks. This is not specific to us, as noted in the post below:
https://support.google.com/cloud/answer/9110914?authuser=2
As of now, we are limited to 100 users connecting accounts before we will no longer be able to accept additional users. Maybe we'll get a helpful response from Google, but considering the lack of notice, I doubt it.
This is why you can't build on a platform like Google; you never know when they will suddenly change policy (or shutdown) without notice and shut you down. No company can stop accepting users for 4-6 weeks while a security audit goes on and stay in business.
- epc 7y agoThis was announced last year: https://www.theregister.co.uk/2019/02/11/google_gmail_developer/ https://www.theregister.co.uk/2019/02/11/google_gmail_develo... It was a reaction to apps & extensions abusing access to users’ email.
- deleted 7y ago[deleted]
- redm 7y agoI remember that happening. If this is the same thing, its even worse as we never got any notice that this was coming or going to impact us.
- mtmail 7y agoJust curious, did the audit cost as much as they estimated? $15k is a serious expense for small companies.
- deleted 7y ago[deleted]
- epc 7y agoA startup I was advising budgeted $75k for their audit, they folded at the end of the year unrelated to the audit, though it didn’t help that they had to pour resources into that while trying to raise more funding.
- Reggi55 7y agoMaybe you sent their emails to spam it was planned ages ago
- redm 7y agoI doubt that. We even have emails from Google tied to Pagerduty so we never miss one. Were also using GSuite for email.
- leshokunin 7y agoHas anyone got recommendations on completing this while being an early stage startup? Besides lowering the API scope.