1

There are lots of apps (on my phone, on the web, etc.) that want to use my google id for authentication and to sync data -- news readers, contact info, notes to google docs, etc. In general, they ask for your google uid and password directly, which seems like a huge security hole to me -- I basically have to trust each app developer with my email login. I'm currently using a secondary gmail address for this sort of thing, but that can be inconvenient.

  • Is there some way to restrict the kind of access that I give the apps?

  • Assuming I'm not missing something, what's the best place in the google universe to post a feature request for better control over this stuff?

4

The current defacto solution for this problem is OAuth, which Google supports. Applications using OAuth don't need your google ID and password to get authorization from Google to access your data.

I'd suggest to the app developers in question to migrate to OAuth.

  • 2
    These days, developers using an authentication method requiring users to enter their passwords directly into a third-party application or website are a diminishing minority. The user should never have to trust a third-party developer with a password for another service. – dgw Aug 16 '10 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.