5

I was reviewing my Google account permissions and noticed some items that I am having some concern in regard to their legitimacy. I'd like to know if there is a good way to determine the legitimacy of a connected app. At the moment I can see no information about the connected app apart of its name.

For example:

  • delgooglelogin - I tried to google this one but got no results. Any idea what's this one? Is that some internal Google stuff or should it be removed?
  • Project Default Service Account - my concern here is the same as before. is this a legitimate item?
  • Google Drive - does Google Drive needs to have a special permission? Isn't it an integral part of the Google account?
Improve this question
4
  • may I ask where exactly where you reviewing your Google account permissions. Link please
    – DaImTo
    May 4, 2017 at 6:34
  • @DaImTo support.google.com/accounts/answer/3466521?hl=en
    – Eugene S
    May 4, 2017 at 6:36
  • Be aware of this current phishing attack: theregister.co.uk/2017/05/03/… "... it's not actually the official Google Docs requesting access: it's a rogue web app with the same name that, if given the green light by unsuspecting marks, then ransacks contact lists and sends out more spam."
    – Vidar S. Ramdal
    May 4, 2017 at 9:01
  • I had delgooglelogin in my account too. And my bet is that it is permissions for the now mostly shutdown delicious bookmarks website.
    – cessationoftime
    Mar 23, 2018 at 3:06

1 Answer 1

Reset to default
5

Every time you connect to a system (web, or mobile app) using your Google Login you are granting the developer of that system access to your account. If you see a window something like this.

enter image description here

The app in question Google Analytics Windows is asking the user for permission to read their Google Analytics data. Once granted the application will have permission to read the data. (When ever they want not just when you have the app open) This is called Oauth2, it is how Google and a lot of other companies allow developers access to your private data. The main point here is that you the user must decided if you trust the developer of the application.

With the Exception of android Apps Google preforms no checks to ensure that the application you are authenticating to is not going to do anything bad with your data. You the user must decide that. Even with android Google cant control what they do in the background.

The first two you have mentioned i cant tell you what they were. The best thing you can do is just remove them. If you are actually using the application that needs the authentication it will pop up and ask you to authenticate again. Just don't auto click accept on these windows check the name. If you do figure out what the applications are i would recommend contacting the developer and telling them they need a more descriptive name then that.

As for the last one. I would guess that you either have a windows Google drive app or an android google drive app that needed to be authenticated before it could access your data. Google is very strict developers cant name their products after a google product. The last one is probably a Google Developed application and should be perfectly safe to use.

As for an answer there is really no way to determine the legitimacy of a connected app. I have been developing applications using google login for years. I can tell you as a developer that if you grant my application access to your data you give me access to your data. There is no way for you to know if i am trustworthy and not selling your data on to someone else. This is why I install very few third party apps :)

Update (Picture just for fun):

This is the setup that a developer would have to include. Note a few of the fields are optional but email is not.

enter image description here

Improve this answer
8
  • Hi and thank you very much for you detailed answer and expert insight. I totally understand that it is up the user (me) to make the right decision in regard to what application I should grant access to. Here I just wanted to know if there is a way of knowing exactly what application or service that is hiding behind a certain name which, as you would probably agree with me, is not always intuitive. What I hoped for is some kind of link that would take me to the app's hope page or something. Now I understand that this is impossible and the only option I have is to remove the permission and wait.
    – Eugene S
    May 4, 2017 at 8:23
  • 1
    The thing is when the developer created their account they have to add a webpage that links to the TOC for their app. I wonder why Google hasn't added this link in the page you were checking so that user can go and figure out who these people are. I have a few contacts at Google i may bring this up with them.
    – DaImTo
    May 4, 2017 at 8:25
  • 1
    I don't think that "Project Default Service Account" is a Google app. Its a strange name and service accounts are not Oauth2 Google knows that. Service account access would not show up on that page. I sent off two mails to Google.
    – DaImTo
    May 4, 2017 at 8:36
  • 1
    There is really no downside to removing access to any app you've authorized in the past. The only thing that will happen is you will again see the auth request page the next time you go to use that app. If you are no longer using the app, you've just removed an un-needed access.
    – Folk
    May 10, 2017 at 15:47
  • 1
    It's what's written in the question. Anyway, I've found the URL (used for developers) to change the name of the app : console.developers.google.com/apis/credentials . So, thank you.
    – android developer
    Jul 31, 2017 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.