4 ms·

Do Google corporate email accounts allow IMAP sync, like gmail accounts? I mean fully-replicated BODY.RFC822 sync, not just headers. I have to assume not, oth

Do Google corporate email accounts allow IMAP sync, like gmail accounts? I mean fully-replicated BODY.RFC822 sync, not just headers. I have to assume not, otherwise everybody using this feature would trigger the same exfiltration-lockout.

KirillPanov 6y ago
Or instead of answering my question people could just downvote me. I guess. Legitimately curious here. "Download all my mail from the mail server" is something I do multiple times every day. I guess my workflow would be verboten in corporate environments? Is it really such an odd behavior that they have an automated check for this, and it isn't throwing false positives every hour? Or is this one of those things they tell you at the "onboarding" like "hey, you might download all your personal gmail via IMAP regularly, but don't do that with your corporate email account or you'll get a phone call from security". Maybe I'm just out of touch with how corporate email works. It's been a decade since I was an employee of a publicly traded company.
- willxinc 6y ago
  Typically this is disallowed from non company devices. If you're allowed to sync your corporate email to your personal devices, that's probably an oversight.
  - deleted 6y ago
    [deleted]
  - KirillPanov 6y ago
    So if IMAP-sync to corporate-owned laptops is a common and allowed use case how did an automated system notice this activity? It's not like the IMAP protocol sends the host MAC address or /etc/machine-id as part of the command stream. I'm really having a hard time imagining a plausible automated security system that would have led to this outcome.
    - TaylorAlexander 6y ago
      I worked at Google and we used gmail, not IMAP, to view email. Corporate laptops allowed logging in to your corporate gmail, but I never saw anyone use IMAP and I have a feeling it wouldn’t be allowed. Once I left Google I had no access to my old corporate emails and I’m sure that’s the way they want it. I did thought experiments about data exfiltration and it would certainly be difficult. They control the OS on your system, they control the network, and they authenticate everything so no anonymous access is allowed. That’s why people get caught - they can see basically everything you’re doing on corporate machines or corporate networks and they know who you are.
    - renewiltord 6y ago
      Well, then, there are at least a few paths of reasoning you can follow: * Google automatically flags this by the volume of data transferred and alerts human eyes * Google's alert erroneously fired and they made a press release about it * Google is lying * Your premise that it is a common and allowed use case is false Why stop when your conclusion is absurd. These paths don't appear to take great creativity to identify.
- esja 6y ago
  In general: if it’s on a corporate server, it’s not your email, it’s corporate IP.
  - KirillPanov 6y ago
    I don't dispute that. I don't think you understood the question.
- chipotle_coyote 6y ago
  The Axios article says: According to a source, Mitchell had been using automated scripts to look through her messages to find examples showing discriminatory treatment of Gebru before her account was locked. Google's own statement, quoted by Axios, says: Yesterday our systems detected that an account had exfiltrated thousands of files and shared them with multiple external accounts. You're taking those as if they say the researcher was just using her mail client the way everybody does, but that's not what they say at all. The first one ("using automated scripts to look through her messages") says nothing about downloading at all; the second, official one, says that "thousands of files" were "shared with multiple external accounts." The allegation is clearly that the researcher wrote scripts to select (an apparently large number of) specific messages and forwarded those messages to people outside the company. Nobody is saying "OMG SHE USED IMAP!". They're saying "She sent internal corporate emails to people outside the corporation."

KirillPanov 6y ago

Or instead of answering my question people could just downvote me. I guess. Legitimately curious here. "Download all my mail from the mail server" is something I do multiple times every day. I guess my workflow would be verboten in corporate environments? Is it really such an odd behavior that they have an automated check for this, and it isn't throwing false positives every hour? Or is this one of those things they tell you at the "onboarding" like "hey, you might download all your personal gmail via IMAP regularly, but don't do that with your corporate email account or you'll get a phone call from security". Maybe I'm just out of touch with how corporate email works. It's been a decade since I was an employee of a publicly traded company.

willxinc 6y ago
Typically this is disallowed from non company devices. If you're allowed to sync your corporate email to your personal devices, that's probably an oversight.
- deleted 6y ago
  [deleted]
- KirillPanov 6y ago
  So if IMAP-sync to corporate-owned laptops is a common and allowed use case how did an automated system notice this activity? It's not like the IMAP protocol sends the host MAC address or /etc/machine-id as part of the command stream. I'm really having a hard time imagining a plausible automated security system that would have led to this outcome.
  - TaylorAlexander 6y ago
    I worked at Google and we used gmail, not IMAP, to view email. Corporate laptops allowed logging in to your corporate gmail, but I never saw anyone use IMAP and I have a feeling it wouldn’t be allowed. Once I left Google I had no access to my old corporate emails and I’m sure that’s the way they want it. I did thought experiments about data exfiltration and it would certainly be difficult. They control the OS on your system, they control the network, and they authenticate everything so no anonymous access is allowed. That’s why people get caught - they can see basically everything you’re doing on corporate machines or corporate networks and they know who you are.
  - renewiltord 6y ago
    Well, then, there are at least a few paths of reasoning you can follow: * Google automatically flags this by the volume of data transferred and alerts human eyes * Google's alert erroneously fired and they made a press release about it * Google is lying * Your premise that it is a common and allowed use case is false Why stop when your conclusion is absurd. These paths don't appear to take great creativity to identify.
esja 6y ago
In general: if it’s on a corporate server, it’s not your email, it’s corporate IP.
- KirillPanov 6y ago
  I don't dispute that. I don't think you understood the question.
chipotle_coyote 6y ago
The Axios article says: According to a source, Mitchell had been using automated scripts to look through her messages to find examples showing discriminatory treatment of Gebru before her account was locked. Google's own statement, quoted by Axios, says: Yesterday our systems detected that an account had exfiltrated thousands of files and shared them with multiple external accounts. You're taking those as if they say the researcher was just using her mail client the way everybody does, but that's not what they say at all. The first one ("using automated scripts to look through her messages") says nothing about downloading at all; the second, official one, says that "thousands of files" were "shared with multiple external accounts." The allegation is clearly that the researcher wrote scripts to select (an apparently large number of) specific messages and forwarded those messages to people outside the company. Nobody is saying "OMG SHE USED IMAP!". They're saying "She sent internal corporate emails to people outside the corporation."