How does security work in a cloud-to-cloud backup scenario?

Question

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup security page it says this:

Spinbackup never requires Google user credentials. We don’t store your passwords on our servers. It cannot access passwords as it uses OAuth 2.0 to access your Google account data, the latest Google API, which allows two-step verification.

My common-sense reaction is that surely if someone has the privilege to back up my email, then that they can also read my email (and probably send email on my behalf too). Without going in to all the details about OAuth2, can someone explain what the above statement means and what security it offers?

Answer 1

How are they limited

Using OAuth, you ask for scopes, which are similar to permissions, this means they can only use the credentials for what they ask for, and cannot do things that are out of scope.

Some of the scopes do cover multiple things though, for example being able to copy an email means they can also read the email, which is not something that OAuth could defend against unless Gmail provided an encrypted access scope, but then if Gmail disappeared so would the decryption keys.

The benefits of using OAuth are:

• You can revoke one app without revoking all of them
• You can change your password without losing your apps
• You can limit what apps do
• Apps need to explicitly ask for scopes, so they can't escalate permissions

What do they ask for

Visually

Behind the scenes

Using data from the docs and a test login I found the following scopes are requested

• email

  View your email address

• profile

  View your basic profile info

• https://mail.google.com/

  Read, send, delete, and manage your email

• https://www.googleapis.com/auth/drive

  View and manage the files in your Google Drive

• https://picasaweb.google.com/data/

  This appears to be an old scope: Info

• https://www.googleapis.com/auth/calendar

  Manage your calendars

• https://www.google.com/m8/feeds/

  Manage your contacts

• https://www.googleapis.com/auth/tasks

  Manage your tasks

Conclusion

As you can see above, they ask for a lot of permissions, in theory, they could get away with the read-only variants of the above, but they may allow you to push data back to your account, which requires being able to write.