Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others.

To work correctly they require a full access scope to the gmail api, which gives them the permission to:

  • View, manage, and permanently delete your mail in Gmail
  • Create, update, and delete labels
  • Compose and send new email
  • View your settings (e.g., filters and labels)

This means that the service gets full access to the entire gmail account at any time, even when the user is offline, right?

What if that service gets hacked or the developers become rogue, can they access accounts and read emails of their clients? What measure of security does Google offer for the api?

Most online account rely on email for security and password reset, if this can be read by 3rd parties then it is not secure anymore.

Update: I contacted Gmelius and they said they only keep hashes of the users email address and id of threads to snooze/schedule. Is this enough to keep us safe?

In other words, when I give an app API access to my gmail account, what can they do at programmatic level? what tokens are they given? can the tokens be used outside of their app?

  • 3
    I don't think you will find anyone who will contradict your assertions. Your identified risks are valid risks. As such, I'm not sure what kind of answer you will get. Can you take a different perspective on the question with the assumption that all your fears are true? – schroeder Jun 22 '16 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.