3rd Party Mail Clients on iPhone/Android and Credential Storage

Question

Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability.

For example, on iPhone we have

Mail (default) Gmail by Google Spark by Readdle

I spoke to Google Apps support today and they say that all authentication credentials when using their app are stored locally for their gmail accounts. I am not sure how the Apple default mail client stores credentials, input would be appreciated! Spark on the other hand says that their "server needs to check and send emails from your email account for [some function's] to work. And to achieve this, we need to store your email account’s access token." Full story here.

Now i am curious

1. Do they really need to store my credentials on their server on iPhone, if so; is this due to iPhone only or would this be Android as well?
2. I have two factor enabled and an app password, is the app password what they would store? Is this my OAuth token in this case?
3. This seems like a great degree of trust that I have to put into a 3rd party application and that their server's don't get hacked?

Thank you very much, if i did not post in the right group; i sincerely apologize; I am simply trying to understand how 3rd party mobile mail clients work. Please point me in the right direction and i will delete this post.

Answer 1

After reading the linked page on Spark, I would say that the problem here is that Spark wants to be more than a mail reader. As a mail reader local to your phone or tablet, they would not need to store your credentials on their servers.

But they want to offer more. As an example they cite push notifications for new emails. For this to work, the spark server as to connect to your different mail accounts see whether new mails have arrived and push the notification to your phone. If this runs on the server, they do not have to maintain complex code on various versions of IOS and Android: the core runs of their servers and only the presentation layer runs on your phone. Running that on their servers also saves resources (CPU and mainly memory) on your phone, and also saves the volume of data exchanged with your phone.

The dark side is that your credentials for your different mail servers have to be known to their servers. And they must be known in clear text because they will have to send them to the actual mail servers.

The alternatives would be:

• run all the core of Spark locally on your device. It could require a powerful device, with plenty of storage and memory and could require a lot of exchanges - unsure whether a google watch could support it... As it would require more maintenance tasks to have it on many OS versions the application would also be more expensive
• get rid of all those nice features and use a mere mail reader - but aren't those nice feature what made you buy their service?

If you think that confidentiality of your mail credentials is more important than all the bells and whistles that come with Spark, do not use Spark. If you do you should use a different password for each email account that would only be used there or at the strict minimum a unique password for all the mail accounts used through Spark that would be used nowhere else.

TL/DR: the features offered by Spark actually require that their servers can read and send mail on behalf of you so they do need to have your mail account credentials. If you do not agree with that, just do not use Spark - what I would do if you ask for my advice...

Answer 2

is this due to iPhone only or would this be Android as well?

Android (at least all standard mail Apps from different Manufactures) stores the Credentials locally but syncs them with your Gmail Account (most ROMs have this on as default behavior although you have the possibility to deactivate that sync)