Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 2 down vote favorite

I was signing up for a web service, when the following prompt showed up. I'm familiar with this process, and I've granted some more finer-grained access to other apps before, but if I recall correctly those all specified WHAT access I was granting. E.g. "Google Calendar: Create and view events". This one doesn't specify anything though. If I click "Grant access", am I giving this app permission to do basically whatever it wants to do? Can it change my password? Can it go and delete emails if it wants?

I tried searching these forums, but couldn't find the answer. :-(

Thanks!

Granting access to webapp

share|improve this question
1  
Sounds fishy. I know you're blacking out the site to prevent us from knowing what it is, but if you don't implicitly trust that site, I would err on the side of caution and not do it. Asking for access to "Gmail" is pretty vague. I doubt it'd let it change your password, but read your emails? Possibly. – allquixotic Sep 20 '12 at 22:15

migrated from superuser.com Sep 20 '12 at 22:47

1 Answer

up vote 3 down vote accepted

The vaguely named "Gmail" access is pretty much giving the application unlimited IMAP/SMTP access to your account (it provides an OAuth login which merely replaces giving it your password). In essence it is pretty much unlimited permission to your Gmail, so yes they could delete all your emails.

Providing any sort of access to your account will be a risk, but you can always revoke permission through your account's security settings.

You did manage to miss blacking out an instance of the URL - so I can note this question has been asked about that site inconclusively before. The site in question is quite popular these days, so unlikely to do anything terrible.

share|improve this answer
Doh! I scanned that thing several times to see if I missed one! Oh well, live and learn. My concern wasn't that the site in question would intentionally do anything surreptitious; more paranoid that if they got hacked, they might accidentally leak the auth keys. Thanks for the answer! – loneboat Sep 21 '12 at 3:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.