Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

On many services, there is the request to connect to your gmail (or other webmail service) account in order to retrieve your contacts information (so to add them to your network in the new service).

This is obviously not secure.

So in such a case, what should you do ?

(I made a second gmail account, copied my contacts there, and used that - but that is not optimal.)

share|improve this question
1  
You can always change your password straight afterwards. This way the access is only a one-off thing and the service will fail if it tries again. NOTE: I'm not recommending that you do, just a way to do it that will minimize the risk –  ChrisF Jul 1 '10 at 14:41
    
Prime example that comes to mind being Facebook, as soon as you create an account... –  pelms Jul 1 '10 at 19:14

5 Answers 5

up vote 17 down vote accepted

"No" is the correct answer--you should never give away your password. Gmail now supports OAuth, an industry standard protocol, enabling you to give your consent for specific access to your mail without sharing your password.

share|improve this answer
    
I am giving you the "answer mark" since you only got 11 points - go check stackoverflow.com , my friend :) –  Tal Galili Jul 1 '10 at 15:44
    
+1: You should never give out passwords. Just, period. If the service requires it, then it's poorly designed. –  Satanicpuppy Jul 9 '10 at 14:21

I recommend not giving them their password. In every case I've seen a service demand that, it does make your life easier, but is entirely optional, and letting people into my Gmail account for a few seconds of convenience is completely not worth it. I'd prefer the pain of simply entering things manually later. Your solution also works, although I agree it's suboptimal.

share|improve this answer
    
It's a tradeoff. Loss of privacy and having to trust a 3rd party vs. convenience. I use a different password for every website, which means it takes me 1-2s extra to log on everywhere so I don't have the risk that one site compromises all my logins. But now it's a hassle to log on to every site. –  Michael Pryor Jul 1 '10 at 14:45

You should run the other way as fast as you can. Don't ever give out your email password unless it is to a junk account.

Ask yourself this. Have I used this email address for any of my online banking, bill payments, or anything else that I would not want everyone on the internet to see? If the answer is yes I have used this email address for this then you know you shouldn't give out the password. Otherwise other people could have permanent access to your credit cards, bank accounts, etc. It isn't worth it.

share|improve this answer

I strongly suggest that you refuse, and furthermore write a complaint to them for asking you to do such a insecure thing.

It is not acceptable for any application to request access to your mail account. Rather, provide the data yourself.


Update: you can also export the Contacts in CSV format from GMail, and provide that as a 'convenience'.

share|improve this answer
    
+1 for the CSV export - this is what I always do in this situation –  Shevek Jul 1 '10 at 14:20
    
Thanks Robert - I agree, but that doesn't work for all services... –  Tal Galili Jul 1 '10 at 14:45

The thing is, for me it isn't my GMail password, it's my Google account password, so that's my email, my blog, my picasaweb, Analytics, Alerts, Calendar, Docs, Groups, Reader...

Oh, and my OpenId too...

Get the idea?

share|improve this answer
1  
You give out your password and they say they will take stuff from your email, but they can take your full web history for the last 5 years, you know, Cause GOOGLE stores it. Just checked out what I was searching back in 2006.. classic –  burnt_hand Jul 9 '10 at 14:34
    
google.com/history –  burnt_hand Jul 9 '10 at 14:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.