4 ms·
If you granted Gitter access to Gitlab, you granted it full read access to everything in your Gitlab account. This is because Gitlab does not yet support restr
by mleonhard 6y ago
If you granted Gitter access to Gitlab, you granted it full read access to everything in your Gitlab account. This is because Gitlab does not yet support restricted access grants [1].
Soon https://element.io https://element.io will have that full access. Now is a good time to check your Gitlab access grants: https://gitlab.com/profile/applications https://gitlab.com/profile/applications
[1] "Support restricting OAuth tokens to specific projects and groups " https://gitlab.com/gitlab-org/gitlab/-/issues/22115 https://gitlab.com/gitlab-org/gitlab/-/issues/22115
- Arathorn 6y agoAbsolutely - at Element we categorically have zero desire to have access to anything in your GL accounts. On the other hand, for the same reason, we’re not going to exploit that :/
- TheRealPomax 6y agoBut the responsible thing to do here is to _throw all that data away_, and force everyone to explicitly grant gitter access to their account again. With only as many rights as necessary, of course. No app needs full account access, all the time. Make the various parts differently authenticated layers.