2

I think many people have been gradually forking over more and more personal information to Google. I was noticing how I now have details about my doctor appointments stored in Google Calendar and on Google Drive I have some phone calls recorded from my phone. I'm not sure if the folks at Google actually view the data but what about third party apps? I wanted to know the size of a folder in Google Drive and it turns out I have to use this app which needs to "view and manage" files on Google Drive. So would allowing this basically be like giving my medical history to some random person?

Are there any resources that explain what the different permissions are?

Improve this question
3

Unless you encrypt all data on the client side, the answer is as easy as: Anything you store with Google is not secure at all, even more so (but not exclusively) if you use third party apps to access the data.

Any app that you use and give access to your Google account can do pretty much anything, from working as you expect to reading and modifying files, or sending your confidential data to someone else. You do not have an easy way of knowing. You'll have to trust the author of that app.

(All of the above is not very particular to Google, however. It applies to every other provider as well.)

As for general security, not only could Google employees in theory read (and modify) any data or deny you access to your data at any time since it's stored on servers that are not under your control (not all Google employees have that level of access, but a considerable number certainly does).
Also, Google will most certainly run automated "data mining scans" over your data. They're a company that makes a living from collecting data and delivering custom-tailored ads as well as selling data (of some more or less unspecified kind) to other companies.
It is not publicly known what methods exactly are applied and what data is collected (anonymized or identifiable) and how much data is stored, nor how exactly it is used. However, it is certain that this is happening (unless they changed their ToS since I last looked, you are agreeing to that, too, by using their service).

In addition to that, Google is an US-based company, and like every US-based company they will deliver your data to governmental agencies without hesitating, and they will neither make this public nor admit to you or to anyone else that they're doing (or have done) it, being bound by what is called "National Security Letter". The nature of a NSL is basically the same as what ordinary blackmailers that are not a governmental agency are doing by telling you "No police, or your child dies".
Except in this case, the threat is something like "Your company shuts down, and you go to jail without trial".

Improve this answer
  • Although all of these things might be true, it doesn't directly answer the OP's question about Google App permissions. – schroeder♦ Mar 6 '15 at 16:23
  • @schroeder: Hmm I thought I did answer that one. If you allow an app to access the internet (no other way if it is to access Google!) and if you give it your Google account password, then you're at the app developer's mercy and have to trust him. I'm not aware of any permission that could conceivably prevent the app from doing evil stuff, given these permissions. – Damon Mar 6 '15 at 16:50
  • @Damon Google App permissions do not work that way. The app does not get your Google password; it gets a token giving it limited access. – cpast Mar 6 '15 at 18:32
  • @cpast: What makes you say that? On the client side (assuming there is a "client", if it's a 3rd party web app you don't even have that control), you can either allow or disallow an app to access the internet. Blocked, it won't be able to access Google (which is what you want!), so you have to allow it. Which however means it can just as well access any other site on the internet, including e.g. the Russian mafia's upload servers. Nothing can prevent the app from stealing any data that it gets to see. As for Google, you have the possibility of letting an "app" ... – Damon Mar 7 '15 at 12:07
  • (what Google calls "app", might as well be a web service) ... access via Google's OpenID service, or via a user/pass combination. It doesn't make a difference. Within your Google account, you can grant "full", "basic profile", or "read and write" access. "Basic" won't work, and the other two will put you at the mercy of the app developer. They can read and write your data (which is what you're asking for!). In summary, there is nothing that prevents a hostile app from reading and then sending your medical records to the Russian mafia (if they're interested in these). – Damon Mar 7 '15 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.