Comments on: The risk of using apps that access your Gmail account http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html Brain candy for Happy Mutants Wed, 22 May 2013 22:38:00 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: kosso http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343563 kosso Sat, 11 Feb 2012 20:24:00 +0000 http://boingboing.net/?p=143361#comment-1343563 Yes. That's right. After you've given an application the rights to access a certain "scope", then it then has access to the data provided by those API endpoints. See also the 'playground' app here, which can let you choose a'scope' and then you can Authorize it, which will then show you the authentication request allow/deny page which a user would see, etc. https://code.google.com/oauthplayground/ Yes. That’s right. After you’ve given an application the rights to access a certain “scope”, then it then has access to the data provided by those API endpoints.

See also the ‘playground’ app here, which can let you choose a’scope’ and then you can Authorize it, which will then show you the authentication request allow/deny page which a user would see, etc.

https://code.google.com/oauthplayground/

]]> By: MrEricSir http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343559 MrEricSir Sat, 11 Feb 2012 20:17:00 +0000 http://boingboing.net/?p=143361#comment-1343559  As far as I can tell that document only applies to the GData API.  As far as I can tell that document only applies to the GData API.

]]> By: kosso http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343505 kosso Sat, 11 Feb 2012 18:38:00 +0000 http://boingboing.net/?p=143361#comment-1343505 Not quite true. Each application you connect has a different "scope" setting.  That might be read/write access to Blogger, YouTube, etc. Or maybe simply to know 'who' you are using your Plus account (no write access here yet). Access to Gmail is a specific one too. See : http://code.google.com/apis/gdata/faq.html#AuthScopes Not quite true. Each application you connect has a different “scope” setting. 
That might be read/write access to Blogger, YouTube, etc. Or maybe simply to know ‘who’ you are using your Plus account (no write access here yet).

Access to Gmail is a specific one too. See : http://code.google.com/apis/gdata/faq.html#AuthScopes

]]> By: . http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343351 . Sat, 11 Feb 2012 15:13:00 +0000 http://boingboing.net/?p=143361#comment-1343351 This is it.. nothing else. No Facebook or Twitter, so no cross site hijinks with that either.  Authorized Access to your Google Account Connected Sites, Apps, and Services You have granted the following services access to your Google Account: "GoogleCL for account: ..........." — Google Calendar [ Revoke Access ]"GoogleCL for account: ..........." — Google Docs [ Revoke Access ]Android Login V1 — Full Account Access [ Revoke Access ] Looks like Microsoft has nothing too.. Manage your shared information You're not sharing information with any sites. This is it.. nothing else. No Facebook or Twitter, so no cross site hijinks with that either.
 Authorized Access to your Google Account
Connected Sites, Apps, and Services
You have granted the following services access to your Google Account:

“GoogleCL for account: ………..” —
Google Calendar
[ Revoke Access ]“GoogleCL for account: ………..” —
Google Docs
[ Revoke Access ]Android Login V1 —
Full Account Access
[ Revoke Access ]

Looks like Microsoft has nothing too..
Manage your shared information
You’re not sharing information with any sites.

]]> By: inedible http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343221 inedible Sat, 11 Feb 2012 06:35:00 +0000 http://boingboing.net/?p=143361#comment-1343221 Really? Just... Really? Really?

Just…

Really?

]]> By: MrEricSir http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343201 MrEricSir Sat, 11 Feb 2012 05:38:00 +0000 http://boingboing.net/?p=143361#comment-1343201 Yeah, this article pretty much makes no sense.  Any software that has your Google credentials can access your Gmail with the default settings.  There's nothing new about this. Yeah, this article pretty much makes no sense.  Any software that has your Google credentials can access your Gmail with the default settings.  There’s nothing new about this.

]]> By: Antinous / Moderator http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343028 Antinous / Moderator Fri, 10 Feb 2012 23:46:00 +0000 http://boingboing.net/?p=143361#comment-1343028 If you type a ) or a . or a , at the end of a link, it's going to end up in the URL. I fix dozens of them every day. If you type a ) or a . or a , at the end of a link, it’s going to end up in the URL. I fix dozens of them every day.

]]> By: toupeira http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343012 toupeira Fri, 10 Feb 2012 23:33:00 +0000 http://boingboing.net/?p=143361#comment-1343012 Ah it looks like BoingBoing added the closing paranthesis to the link, and I also have user account switching enabled which adds the "/b/0" to the URL. I've edited the comment so it hopefully works now. Ah it looks like BoingBoing added the closing paranthesis to the link, and I also have user account switching enabled which adds the “/b/0″ to the URL. I’ve edited the comment so it hopefully works now.

]]> By: Godfree http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1343007 Godfree Fri, 10 Feb 2012 23:31:00 +0000 http://boingboing.net/?p=143361#comment-1343007 I clicked your link but got "The page you requested is invalid."  I was able to access  https://www.google.com/settings/ which then let me into my own account and fiddle with the controls there. Thanks, toupeira! I clicked your link but got “The page you requested is invalid.”  I was able to access 
https://www.google.com/settings/ which then let me into my own account and fiddle with the controls there. Thanks, toupeira!

]]> By: Mr_Smooth http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342910 Mr_Smooth Fri, 10 Feb 2012 21:51:00 +0000 http://boingboing.net/?p=143361#comment-1342910 Everyone should check the link provided by toupeira to see what you've authorized. You may be surprised. I noticed that to sign up for commenting at the Chicago Tribune site using OAuth, you give the Trib access to your Gmail contacts. I deleted everything that had anything more than "Sign in using your Google account " Everyone should check the link provided by toupeira to see what you’ve authorized. You may be surprised.

I noticed that to sign up for commenting at the Chicago Tribune site using OAuth, you give the Trib access to your Gmail contacts.

I deleted everything that had anything more than “Sign in using your Google account “

]]> By: brianary http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342747 brianary Fri, 10 Feb 2012 20:10:00 +0000 http://boingboing.net/?p=143361#comment-1342747 Yeah, that's not actually what's happening. OAuth collects a token after *Google* authenticates you and confirms the intent that was sent. Yeah, that’s not actually what’s happening. OAuth collects a token after *Google* authenticates you and confirms the intent that was sent.

]]> By: Poke With Stick http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342745 Poke With Stick Fri, 10 Feb 2012 20:09:00 +0000 http://boingboing.net/?p=143361#comment-1342745 I think people need to understand OAuth before think it is the issue. OAuth allows you to give access to a third party without needing to give them your credentials. What the article is saying is that this is done so easily people are not considering what they are allowing access to. Nothing new here and it shouldn't about OAuth.  I think people need to understand OAuth before think it is the issue. OAuth allows you to give access to a third party without needing to give them your credentials. What the article is saying is that this is done so easily people are not considering what they are allowing access to. Nothing new here and it shouldn’t about OAuth. 

]]> By: toupeira http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342742 toupeira Fri, 10 Feb 2012 20:07:00 +0000 http://boingboing.net/?p=143361#comment-1342742 Only apps with the "GMail" permission will have full access to your mails (you can see all your authorized apps at https://accounts.google.com/IssuedAuthSubTokens ). Most sites I use only have the "Sign in using your Google account" permission, which shouldn't give access to any data. But yeah, the authorization dialog could be a lot more clear about what permissions you're granting exactly. Only apps with the “GMail” permission will have full access to your mails (you can see all your authorized apps at https://accounts.google.com/IssuedAuthSubTokens ). Most sites I use only have the “Sign in using your Google account” permission, which shouldn’t give access to any data.

But yeah, the authorization dialog could be a lot more clear about what permissions you’re granting exactly.

]]> By: Lynda Williams http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342722 Lynda Williams Fri, 10 Feb 2012 19:51:00 +0000 http://boingboing.net/?p=143361#comment-1342722 It would be good to have an answer to that, wolfwitch! Gad. Does this mean we all have to start reading the fine print for every click through? The world needs a vetting service for acceptable and unacceptable fine print that regular people can check out for comfort. Sort of like a writer's beware site. It would be good to have an answer to that, wolfwitch! Gad. Does this mean we all have to start reading the fine print for every click through? The world needs a vetting service for acceptable and unacceptable fine print that regular people can check out for comfort. Sort of like a writer’s beware site.

]]> By: wolfwitch http://boingboing.net/2012/02/10/the-risk-of-using-apps-that-ac.html#comment-1342703 wolfwitch Fri, 10 Feb 2012 19:43:00 +0000 http://boingboing.net/?p=143361#comment-1342703 I'm no security expert- but I thought OpenAuth only authenticated a given user. I don't believe it allows a Web site that uses it to actually access any of your Google services. I’m no security expert- but I thought OpenAuth only authenticated a given user. I don’t believe it allows a Web site that uses it to actually access any of your Google services.

]]>