5 ms·

Kind of confused by this heroku error message I received? Are you storing my gmail credentials on heroku? When I tried again I have a google /looking/ login scr

Kind of confused by this heroku error message I received? Are you storing my gmail credentials on heroku? When I tried again I have a google /looking/ login screen? http://cl.ly/1p0M0o2t0H1E3Z1h3i0n http://cl.ly/1p0M0o2t0H1E3Z1h3i0n

nestlequ1k 14y ago
I think they are mimicking the Google Login page and just saving your username/password. Seems damn fishy to me.
- mukaiji 14y ago
  no. these guys are legit. they work in our sandhill office. They're not out to steal your login credentials.
  - drivebyacct2 14y ago
    If they're legit, why are they not using oAuth?
    - tonyx 14y ago
      We are using Google's oauth2 protocol. No user password is stored or even ever transmitted to our server.
      - drivebyacct2 14y ago
        Well I'm not at a Mac so I can't confirm but it's unfortunate to see such misinformation in this thread. I apologize for repeating it, I was too trusting of other comments.
      - nestlequ1k 14y ago
        Since you are framing in the login with webkit, why not show the URL as well? User's need to see htts://google.com or they'll assume it's a phishing attack.
        ryanwaggoner 14y ago
        How is this actually any more secure? It's pretty easy to display a legit (but "fake") URL while your phishing form is displayed in the webview.
natrius 14y ago
I haven't used this so I'm not sure what's going on, but I believe OAuth involves a redirect back to servers controlled by the third party to actually do something with the authentication token. This doesn't strike me as necessarily fishy.
- bdittmer 14y ago
  I guess I don't understand why they even need to store anything on their servers?
  - jordanlee 14y ago
    Hi bdittmer, we don't store any of your content, nor any of your passwords. We only store meta data that describes the organization of your documents and do so server-side so that we can add features in an upcoming release that we otherwise wouldn't be unable to add.
    - urbanjunkie 14y ago
      You need to be way more transparent about what you're storing and why - a native client app implies nothing in the middle.
    - bdittmer 14y ago
      Got it. You guys should read up on iCloud :)
    - sjwright 14y ago
      Storing stuff? Isn't that what my hard disk is for? If I wanted a cloud solution, I'd just log into Google Docs directly. I would have thought the whole point of an app like this is to take advantage of the benefits of native UI, not to add yet another point of failure.

nestlequ1k 14y ago

I think they are mimicking the Google Login page and just saving your username/password. Seems damn fishy to me.

mukaiji 14y ago
no. these guys are legit. they work in our sandhill office. They're not out to steal your login credentials.
- drivebyacct2 14y ago
  If they're legit, why are they not using oAuth?
  - tonyx 14y ago
    We are using Google's oauth2 protocol. No user password is stored or even ever transmitted to our server.
    - drivebyacct2 14y ago
      Well I'm not at a Mac so I can't confirm but it's unfortunate to see such misinformation in this thread. I apologize for repeating it, I was too trusting of other comments.
    - nestlequ1k 14y ago
      Since you are framing in the login with webkit, why not show the URL as well? User's need to see htts://google.com or they'll assume it's a phishing attack.
      - ryanwaggoner 14y ago
        How is this actually any more secure? It's pretty easy to display a legit (but "fake") URL while your phishing form is displayed in the webview.

natrius 14y ago

I haven't used this so I'm not sure what's going on, but I believe OAuth involves a redirect back to servers controlled by the third party to actually do something with the authentication token. This doesn't strike me as necessarily fishy.

bdittmer 14y ago
I guess I don't understand why they even need to store anything on their servers?
- jordanlee 14y ago
  Hi bdittmer, we don't store any of your content, nor any of your passwords. We only store meta data that describes the organization of your documents and do so server-side so that we can add features in an upcoming release that we otherwise wouldn't be unable to add.
  - urbanjunkie 14y ago
    You need to be way more transparent about what you're storing and why - a native client app implies nothing in the middle.
  - bdittmer 14y ago
    Got it. You guys should read up on iCloud :)
  - sjwright 14y ago
    Storing stuff? Isn't that what my hard disk is for? If I wanted a cloud solution, I'd just log into Google Docs directly. I would have thought the whole point of an app like this is to take advantage of the benefits of native UI, not to add yet another point of failure.