4 ms·

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an e

> and has the ability to access data from or through a third party server So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/native-app https://developers.google.com/identity/protocols/oauth2/nati...

easton 4y ago
I’m super confused about this too, there’s tons of open source apps that use Sign in with Google. Shoot, I’ve used the SDK myself in little apps and never saw this.
- rjzzleep 4y ago
  The SDK on android or ios you mean? Cause that would be vastly different from adding a web authentication flow such as oauth to a legacy application.
- Alex3917 4y ago
  "Sign in with Google" is just a button that apps are required to use when they allow the user to interact with Google in some capacity, but don't have their own account management system. Most apps with that button don't have the ability to get any data from Google other than your name and email address though; for apps where you are granting OAuth access to your Gmail, it is very obvious that you are doing so, so it's not likely that you have done it accidentally in the past. (Although you can obviously check on myaccount.google.com)
snthd 4y ago
Most mail clients can connect to both a google email account and a "third party server" email account. It's easier to rule out undetectable-by-google data exfilteration if the app can only connect to Google. The obvious way around this is to make a Google-only edition. Yuck.
- solar-ice 4y ago
  I don't think that's what Google are saying here. I think the sentence is referring to Google user data; as long as the Google user data or credentials to access it does not touch another server, the entire thing does not apply. In fact, in Google's guidance on this subject, they say: > Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement [to get a Letter of Assessment]. And in another FAQ: > Local Data Storage: Local client applications don't need to undergo a security assessment because data is run, stored, and processed only on the user's device. Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement. My feeling is that the author of Pegasus Mail has checked a checkbox incorrectly somewhere, or alternatively has not implemented the desktop oauth2 flow correctly.
- oefrha 4y ago
  This is about the OAuth server-side flow vs client-side flow. Nothing to do with third party email accounts whatsoever. My unfounded guess is that just like the parent here, OP isn’t very knowledgeable about OAuth and chose the wrong flow.

easton 4y ago

I’m super confused about this too, there’s tons of open source apps that use Sign in with Google. Shoot, I’ve used the SDK myself in little apps and never saw this.

rjzzleep 4y ago
The SDK on android or ios you mean? Cause that would be vastly different from adding a web authentication flow such as oauth to a legacy application.
Alex3917 4y ago
"Sign in with Google" is just a button that apps are required to use when they allow the user to interact with Google in some capacity, but don't have their own account management system. Most apps with that button don't have the ability to get any data from Google other than your name and email address though; for apps where you are granting OAuth access to your Gmail, it is very obvious that you are doing so, so it's not likely that you have done it accidentally in the past. (Although you can obviously check on myaccount.google.com)

snthd 4y ago

Most mail clients can connect to both a google email account and a "third party server" email account. It's easier to rule out undetectable-by-google data exfilteration if the app can only connect to Google. The obvious way around this is to make a Google-only edition. Yuck.

solar-ice 4y ago
I don't think that's what Google are saying here. I think the sentence is referring to Google user data; as long as the Google user data or credentials to access it does not touch another server, the entire thing does not apply. In fact, in Google's guidance on this subject, they say: > Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement [to get a Letter of Assessment]. And in another FAQ: > Local Data Storage: Local client applications don't need to undergo a security assessment because data is run, stored, and processed only on the user's device. Local client applications that only allow user-configured transmissions of Restricted Scope data from the device may be exempt from this requirement. My feeling is that the author of Pegasus Mail has checked a checkbox incorrectly somewhere, or alternatively has not implemented the desktop oauth2 flow correctly.
oefrha 4y ago
This is about the OAuth server-side flow vs client-side flow. Nothing to do with third party email accounts whatsoever. My unfounded guess is that just like the parent here, OP isn’t very knowledgeable about OAuth and chose the wrong flow.