Blog, Simple Gmail Notes, Simple Mobile CRM
What could possibly go wrong if you clicked an ‘Allow’ in the Gmail grant page?
Most people have seen a permission grant screen like before, but not many actually understand what it means.
In fact, we were not aware of the implications until we started our development of Gmail API based app. It’s actually surprising and stunning that a simple grant screen could possibly lead to.
In short, when you agreed on this one, the product could:
1. quietly read all your emails
2. quite search all your legacy emails, no matter how old the emails are, and download the corresponding attachments,
3. quietly send emails to others on your behalf, with whatever content generated by the app
4. quietly and permanently delete the inbox or sent box emails created by you, or by the product
So, just imagine, how far the product could go if some hacker hacked into the system?
And the worst part is, the product could still perform all the actions after you killed or deleted it. Yes, the product server could silently access your emails any time, even if you are not using the product.
Sounds unlikely? It definitely happened before. Admittedly things got better after the Google introduced a new policy specificly for Gmail and Google drive data.
Most Gmail add-on companies today are reliable and unlikely to actively steal your data, but can you trust those companies to be as hacker-proof as Google?
At least, we don’t trust most of them, in the same way as we don’t trust ourselves.
Of course, we did every possible thing to safeguard and encrypt our servers. However, it’s still unlikely to build the firewall as strong as Google’s, obviously.
Therefore, we don’t collect any server side token in Simple Mobile CRM. Not only do we collect the least intrusive permission for Gmail (readonly access), all our collected tokens are only applicable on mobile devices. This means those special tokens can never be used in servers, by design.
With Simple Mobile CRM, all Gmail collections must be performed on your mobile phone. If you log out or delete the app, CRM system could never reach your emails, by anyone.
For more details, one may check here.
