A lot (at least on iOS) of third-party mail apps ask for your account credentials.

The background of my question is basically the same as this one: 3rd Party Mail Clients on iPhone/Android and Credential Storage

For example, Dispatch explicitly states:

Because of that, we do not store your credentials anywhere else besides in the secure keychain of your device. Your credentials are never transmitted anywhere else besides to your own mail server for authentication.

Unfortunately, it seems Dispatch is the only one that does that. Calendar apps, on the other hand, don't seem to have the same problem and can just use the accounts that are already stored on the phone.

Can I really trust these mail apps? If I give them my info, anyone that has access to their server has access to my mail. Even if I am using 2FA, their server is now trusted, right? Seems like a serious security risk to me, but if the practice is so widespread, am I just being paranoid?

Update: This has been marked as a duplicate because there is another similar question How does Mail.app handle account credentials? but that focuses on Mail.app. My main question is how concerned I should be about all the third-party mail apps. It seems crazy to provide credentials to your email (especially something like a Google account, which has a lot more than just email). However, millions of people are doing it and I haven't heard of any problems, so maybe it should not be a concern. I just want to get some opinions from people who are more knowledgeable than me.

  • anyone that has access to their server according to their claims the credentials never leave your device, so assuming you trust them to not lie about this fact, their server doesn't have access to your credentials and you are safe even if they get compromised. – André Borie Jan 4 '17 at 14:27
  • @AndréBorie For Dispatch, I agree. I meant for all the other apps that store credentials on their server and admit it. Isn't that a huge a security risk? – burger Jan 4 '17 at 19:41
  • The edit makes the question from a duplicate to being too broad. It is impossible for us to evaluate how much you can trust any mail application which currently exist, i.e. how it behaves now and how it will behave in the future. It is also impossible to evaluate future apps which don't even exist yet. But I'm pretty sure that there are some apps you better don't trust. – Steffen Ullrich Jan 7 '17 at 22:06

Browse other questions tagged or ask your own question.