Recently more and more online services are popping up to help manage the mail of Gmail, such as Boomerang, Gmelius and many others.
To work correctly they require a full access scope to the gmail api, which gives them the permission to:
- View, manage, and permanently delete your mail in Gmail
- Create, update, and delete labels
- Compose and send new email
- View your settings (e.g., filters and labels)
This means that the service gets full access to the entire gmail account at any time, even when the user is offline, right?
What if that service gets hacked or the developers become rogue, can they access accounts and read emails of their clients? What measure of security does Google offer for the api?
Most online account rely on email for security and password reset, if this can be read by 3rd parties then it is not secure anymore.
Update: I contacted Gmelius and they said they only keep hashes of the users email address and id of threads to snooze/schedule. Is this enough to keep us safe?
In other words, when I give an app API access to my gmail account, what can they do at programmatic level? what tokens are they given? can the tokens be used outside of their app?