Slashdot Mirror
Google Allows Outside App Developers To Read People's Gmails, Says Report (thisisinsider.com)
According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative.
What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails.
What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails.
Oh my god, my private porn now is public?
...who allows employees to read your email without consent.
https://www.bbc.com/news/business-26677607
Of course they do. What else would you expect? It's Google.
Cloud = letting untrustworthy and/or incompetent companies manage your own data.
Roll-your-own IT = hard (as in, really hard - I'm not talking managing 5 servers in a small company), but as good and/or competent as you/your organization is willing to be.
The former looks like a good, cost-effective option until the company that manages your data screws your over or the internet goes down. The latter then starts to look like a better deal - but by then, it's too late.
Now then, ask yourself: is Google competent? Probably. Trustworthy? Hell no...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Everything in Gmail, 365, Hotmail, the Cloud that is not encrypted IS being accessed by who knows who. And if that is not OK changes need to be made.
;)
Just my 2 cents
More and more complaints on Googles lack of transparency, brutal blocking of Adwords / Cloud Compute accounts with no human appeal process,
disclosing user data, altering search results and general disrespect for their customers and the public.
It's the beginning of the end for them.
Don't trust someone to read your email? Then don't give them access to your email.
This is an opt-in process that is clearly disclosed when you sign up for whatever random app requests access to your email. Nothing sneaky or underhanded at all, at least not on the part of Google. Maybe it's foolish to grant access to these apps, but that's the user's decision. Frankly the fact that Google performs any sort of vetting at all is more than they need to do.
The only thing that Google could stand to improve is the control and granularity of the permissions. Just as Android has been moving to a blurry, vague model for permissions where average users have no idea what they're actually permitting, it's no surprise that users of Google's web services are experiencing similar problems. If nothing else, reading mail, sending mail, and managing mail you've received should all be separate permissions.
the hell does that even mean??
Unfortunately, you pretty much have to trust somebody.
Hosting your own email on your own server is not easy. It's not going to be the common way for all but a few odd geeks.
The rest? Gotta trust somebody ... your ISP, or Gmail, or MS, or some guys in Switzerland who assure you that they are the safe option, or ...
Trump voters enjoy big black cock.
Read the article you linked to. You consent to it when you agree to the terms of service:
The search was legal because it fell within Microsoft's terms of service which state that the company can access information in accounts that are stored on its "Communication Services", which includes email, chat areas, forums, and other communication facilities.
The terms of service add: "Microsoft reserves the right to review materials posted to the Communication Services and to remove any materials in its sole discretion."
If you don't like the terms of service then don't use the service!
... but say they are not, yeah?
Do No Evil. - lolol
This! is why I don't use google or facebook to login to 3rd party sites
> Hundreds of app developers electronically "scan" inboxes of the people who signed up for some of these programs, and in some cases, employees do the reading, the paper reported.
So, let me get this straight... someone is making a big deal out of the fact that if you give a company permission to read your emails, they might read your emails? And once they have your emails, they might make use of them for something other than what they said, or actual real people might look at them?
This is a surprise to... who, exactly?
"Journalism" of the highest order, obviously.
I'm sure you could get a lot of perverts to provide a privacy agreement and pass a vetting process. If they're really big perverts, they can start working for the NSA.
So while the 3rd party developers will read through your emails at their pleasure for naked pictures and your private tax information, they promise not to tell your husband/wife who you are sending those naked pictures to.
These people explicitly signed up for the service and granted it access. Look at the screen caps in the linked article:
https://amp.thisisinsider.com/...
It says right there "VIEW ... YOUR EMAIL IN GMAIL". If you were dumb enough to do this, and want to undo it, just go to your account settings and revoke that developers' access.
thenyoumustkillthem.
This only applies for the non-business service. Just like the post yesterday about the Google cloud account that was shut down for "suspicious activity" when they didn't pay for business level service either, and had no SLA in place. If you want real privacy, make sure your Google apps account is under a BAA and claim you will handle HIPAA data. They would be crazy to allow a third part to view your mail then.
Google is NOT giving anyone access to users email inboxes. Period. Full stop. End of story. Shame on Slashdot editors for ever allowing this submission.
USERS are giving 3rd party sites access to their own email by clicking "accept" on OAUTH2 requests that explicitly tell the user in big bold letters that by clicking OK they will be giving a 3rd party access to "VIEW MANAGE AND DELETE YOUR EMAIL, COMPOSE AND SEND NEW EMAIL". This isn't misleading, subtle, or accidental access - it is gross incompetence on the part of the user.
Read more here: https://en.wikipedia.org/wiki/...
But fake news generates fake headlines and fake outrage which leads to higher click-thru rates and more ad impressions for the website.
Ever since I installed that inbox app, my emails are.clumoed together in groups and my travel itineraries are grouped and analysed. I need to now assume I am affected.
How do I opt out? There isn't any easy information, nor did I ever give permission to 3rd parties to read my emails. That's unacceptable. If using Gmail means I have to give permission to this, this will stop me using them after signing up in the early days of the invite only process.
Any site that provides web-based email must scan it to prove an attempt to comply with FOSTA's requirement to make sure their site isn't enabling coordination of sex trafficking. Otherwise, they could lose big in a civil suit.
Given that that is required, just assume your email is no longer private unless you're encrypting it.
All free email providers read your email. That's why it's free, dummy.
I don't respond to AC's.
Google has made my ever-expanding list of "free" services I'm going to have to stop using.
Our reign has gone on long enough. Indeed. Summon the meteors.
If you still trust Google, you are either 14 or a Google employee. Everyone else knows better. They aren't going to stop until they are forced to.
This is true, but you'll never find my email on a large centralized email solution.
Live by the cloud, die by the cloud. Security and privacy are different things. Google knows lots about both. Sadly, they know how to break privacy and doing so is their primary business model.
I've been running email servers about 25 yrs now. The real server is at home with a 2-way gateway sitting on a $5/month VPS. Protected by Smith & Wesson with FDE too. The VPS is patched daily, current, maintained. The real email server in my home office only accepts and sends email to that VPS box. It is patched weekly and doesn't really sit on the internet.
I won't run my own public DNS. Got burned in 2002 over that, but email isn't nearly THAT hard.
If someone wants access to the email server, they'll need to break into our home. Breaking in wouldn't be hard, but some trace would be left behind and I'd know it had happened. FDE is a nice thing to have and a hassle, but at least we know when data is being stolen.
Unlike with cloudy providers of anything, where you only know what you've been told. There's no way to verify anything.
Don't fret over privacy (hey, our whole business model is based on fucking over your personal data, after all!).
Guess you get what you pay for.
My take? Avoid Google. Avoid Facebook. And Amazon, Microsoft, Apple. And a bunch of others.
All that's in my GMail account is a furry porn collection.
It's the online equivalent of sending live tics with the mail in a state that has its security routinely open envelopes...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Here's a link to check what 3rd party apps have account access and what type
https://myaccount.google.com/permissions