Slashdot Mirror
Google Allows Outside App Developers To Read People's Gmails, Says Report (thisisinsider.com)
According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative.
What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails.
What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails.
Oh my god, my private porn now is public?
Cloud = letting untrustworthy and/or incompetent companies manage your own data.
Roll-your-own IT = hard (as in, really hard - I'm not talking managing 5 servers in a small company), but as good and/or competent as you/your organization is willing to be.
The former looks like a good, cost-effective option until the company that manages your data screws your over or the internet goes down. The latter then starts to look like a better deal - but by then, it's too late.
Now then, ask yourself: is Google competent? Probably. Trustworthy? Hell no...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Everything in Gmail, 365, Hotmail, the Cloud that is not encrypted IS being accessed by who knows who. And if that is not OK changes need to be made.
;)
Just my 2 cents
Don't trust someone to read your email? Then don't give them access to your email.
This is an opt-in process that is clearly disclosed when you sign up for whatever random app requests access to your email. Nothing sneaky or underhanded at all, at least not on the part of Google. Maybe it's foolish to grant access to these apps, but that's the user's decision. Frankly the fact that Google performs any sort of vetting at all is more than they need to do.
The only thing that Google could stand to improve is the control and granularity of the permissions. Just as Android has been moving to a blurry, vague model for permissions where average users have no idea what they're actually permitting, it's no surprise that users of Google's web services are experiencing similar problems. If nothing else, reading mail, sending mail, and managing mail you've received should all be separate permissions.
the hell does that even mean??
Unfortunately, you pretty much have to trust somebody.
Hosting your own email on your own server is not easy. It's not going to be the common way for all but a few odd geeks.
The rest? Gotta trust somebody ... your ISP, or Gmail, or MS, or some guys in Switzerland who assure you that they are the safe option, or ...
Read the article you linked to. You consent to it when you agree to the terms of service:
The search was legal because it fell within Microsoft's terms of service which state that the company can access information in accounts that are stored on its "Communication Services", which includes email, chat areas, forums, and other communication facilities.
The terms of service add: "Microsoft reserves the right to review materials posted to the Communication Services and to remove any materials in its sole discretion."
If you don't like the terms of service then don't use the service!
I don't think so.
- General-public, apparently-free Google services are used by individuals who don't know better, mostly don't give a damn about privacy and data protection, and just don't want to pay a cent to have access to stuff. Not to mention, Google having become a virtual monopoly, good luck finding alternatives to many services that have become essential. No, Vimeo or Dailymotion aren't as good as Youtube. And Google managed to make their products so amazingly good and attractive that using something else for the sake of principles is really, really painful.
- Enterprise-level Google products are targeted at companies that mostly care about how much they can save by getting rid of their IT people and infrastructure, and don't seem to understand the intrinsic value of the company's data and the risk associated with sharing it or losing it.
Google is a drug that's really hard to wean yourself of, whether you're Joe Consumer or a company. And as much as I hate to say it, that's to Google's credit. So no, it's not the beginning of the end at all for them: their future looks very bright indeed - and that of those who don't want to live in a corporate surveillance society, bleaker by the day.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Again, you don't seem to realize that scanning Google customers' inboxes doesn't only impact Google customers, but anybody who emails them as well. Half of the content of anybody's inbox is composed of messages they received from somebody else, who may or may not agree to have their emails scanned by Google themselves.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
A computer system internal to a brand for their own ads was what most people would have expected.
Not hundreds of app developers.. AC
Domestic spying is now "Benign Information Gathering"
Its all anonymized about humans so its ok?
Domestic spying is now "Benign Information Gathering"
These people explicitly signed up for the service and granted it access. Look at the screen caps in the linked article:
https://amp.thisisinsider.com/...
It says right there "VIEW ... YOUR EMAIL IN GMAIL". If you were dumb enough to do this, and want to undo it, just go to your account settings and revoke that developers' access.
This only applies for the non-business service. Just like the post yesterday about the Google cloud account that was shut down for "suspicious activity" when they didn't pay for business level service either, and had no SLA in place. If you want real privacy, make sure your Google apps account is under a BAA and claim you will handle HIPAA data. They would be crazy to allow a third part to view your mail then.
Google is NOT giving anyone access to users email inboxes. Period. Full stop. End of story. Shame on Slashdot editors for ever allowing this submission.
USERS are giving 3rd party sites access to their own email by clicking "accept" on OAUTH2 requests that explicitly tell the user in big bold letters that by clicking OK they will be giving a 3rd party access to "VIEW MANAGE AND DELETE YOUR EMAIL, COMPOSE AND SEND NEW EMAIL". This isn't misleading, subtle, or accidental access - it is gross incompetence on the part of the user.
Read more here: https://en.wikipedia.org/wiki/...
But fake news generates fake headlines and fake outrage which leads to higher click-thru rates and more ad impressions for the website.
All free email providers read your email. That's why it's free, dummy.
I don't respond to AC's.
Google has made my ever-expanding list of "free" services I'm going to have to stop using.
Our reign has gone on long enough. Indeed. Summon the meteors.
All that's in my GMail account is a furry porn collection.
It's the online equivalent of sending live tics with the mail in a state that has its security routinely open envelopes...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
One important caveat, I do not believe that link (https://myaccount.google.com/permissions) automatically includes all 3rd parties. For others, here is an article about this, that is NOT behind a paywall, from the BBC dated July 3, 2018: https://www.bbc.com/news/technology-44699263.
Like everything online, the devil is in the details and most people (me included sometimes) do not make time to dig into the details...deep in the bowls of the FREE website. Hey its FREE, we are giving them something, else its not cost effective for them to provide that service for FREE.
And if you do read the Terms of Service (ToS) of every website, there is a very good chance you would miss the sentenance where you gave them access to everything about you as they are rarely straight forward.
For Reference:
https://www.bbc.com/news/business-26677607Here is a 2012 article about this same issue with Microsoft
I am sure I could find this for every other email service, especially if it is free, online, to be honest I do not want to bother looking.
An important point to consider,
, is that if you have given a 3rd party access, even when you later turn it off, it will NOT automatically turn off ALL 3rd Party access, only future 3rd party access.
Look for a place where each app is listed and can individually be turned off if you want to later block third party applications!