Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are lots of apps (on my phone, on the web, etc.) that want to use my google id for authentication and to sync data -- news readers, contact info, notes to google docs, etc. In general, they ask for your google uid and password directly, which seems like a huge security hole to me -- I basically have to trust each app developer with my email login. I'm currently using a secondary gmail address for this sort of thing, but that can be inconvenient.

  • Is there some way to restrict the kind of access that I give the apps?

  • Assuming I'm not missing something, what's the best place in the google universe to post a feature request for better control over this stuff?

share|improve this question
up vote 4 down vote accepted

The current defacto solution for this problem is OAuth, which Google supports. Applications using OAuth don't need your google ID and password to get authorization from Google to access your data.

I'd suggest to the app developers in question to migrate to OAuth.

share|improve this answer
These days, developers using an authentication method requiring users to enter their passwords directly into a third-party application or website are a diminishing minority. The user should never have to trust a third-party developer with a password for another service. – dgw Aug 16 '10 at 5:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.