9

On many services, there is the request to connect to your Gmail (or other webmail service) account in order to retrieve your contacts information (so to add them to your network in the new service).

This is obviously not secure.

So in such a case, what should you do?

(I made a second Gmail account, copied my contacts there, and used that - but that is not optimal.)

Improve this question
2
  • 1
    You can always change your password straight afterwards. This way the access is only a one-off thing and the service will fail if it tries again. NOTE: I'm not recommending that you do, just a way to do it that will minimize the risk
    – ChrisF ♦
    Jul 1, 2010 at 14:41
  • Prime example that comes to mind being Facebook, as soon as you create an account...
    – pelms
    Jul 1, 2010 at 19:14

5 Answers 5

Reset to default
18

"No" is the correct answer--you should never give away your password. Gmail now supports OAuth, an industry standard protocol, enabling you to give your consent for specific access to your mail without sharing your password.

Improve this answer
2
  • I am giving you the "answer mark" since you only got 11 points - go check stackoverflow.com , my friend :)
    – Tal Galili
    Jul 1, 2010 at 15:44
  • +1: You should never give out passwords. Just, period. If the service requires it, then it's poorly designed.
    – Satanicpuppy
    Jul 9, 2010 at 14:21
6

I recommend not giving them their password. In every case I've seen a service demand that, it does make your life easier, but is entirely optional, and letting people into my Gmail account for a few seconds of convenience is completely not worth it. I'd prefer the pain of simply entering things manually later. Your solution also works, although I agree it's suboptimal.

Improve this answer
1
  • It's a tradeoff. Loss of privacy and having to trust a 3rd party vs. convenience. I use a different password for every website, which means it takes me 1-2s extra to log on everywhere so I don't have the risk that one site compromises all my logins. But now it's a hassle to log on to every site.
    – Michael Pryor
    Jul 1, 2010 at 14:45
5

You should run the other way as fast as you can. Don't ever give out your email password unless it is to a junk account.

Ask yourself this. Have I used this email address for any of my online banking, bill payments, or anything else that I would not want everyone on the internet to see? If the answer is yes I have used this email address for this then you know you shouldn't give out the password. Otherwise other people could have permanent access to your credit cards, bank accounts, etc. It isn't worth it.

Improve this answer
4

I strongly suggest that you refuse, and furthermore write a complaint to them for asking you to do such a insecure thing.

It is not acceptable for any application to request access to your mail account. Rather, provide the data yourself.

Update: you can also export the Contacts in CSV format from GMail, and provide that as a 'convenience'.

Improve this answer
0
2

The thing is, for me it isn't my GMail password, it's my Google account password, so that's my email, my blog, my picasaweb, Analytics, Alerts, Calendar, Docs, Groups, Reader...

Oh, and my OpenId too...

Get the idea?

Improve this answer
1
  • 1
    You give out your password and they say they will take stuff from your email, but they can take your full web history for the last 5 years, you know, Cause GOOGLE stores it. Just checked out what I was searching back in 2006.. classic
    – Dan
    Jul 9, 2010 at 14:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.