<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">On 1 May 2019, at 0:42, Annamarie Pluhar wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">As a non-geek (and a grateful MM user!) what I think I’m understanding is that google might require some type of pricey audit that Benny can’t afford out of his own pocket. Is that right?</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">Well, this is still not quite clear to me. I'm mainly writing about it on the mailing list as a very early warning of a possible future problem if I cannot complete the verification process. It might be premature and there might not be a problem at all, but I have to somehow complete the verification process.</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">If that’s true perhaps all of us users could contribute to a crowd-sourced fund to pay for same. ??</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">It's possible that MailMate cannot survive without Gmail-users, but crowd funding an audit is not the solution. The higher end of an audit ($75000) is far more than I currently make in a year and I assume security audits would be needed again for future releases of MailMate. And in theory, other companies might follow the example of Google and then an audit might be needed for Apple, Microsoft, Yahoo, etc. (Currently, OAuth2 is only used for Outlook and Gmail.)</p>
<p dir="auto">For now, I'm assuming the problem will go away when I figure out how to complete the verification process without an audit.</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">Before we jump to that - does someone understand why Google might want this audit? I don’t know how many users there are but perhaps google could not require the audit? What does it do?</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">I think it's all about protecting user data. A security assessment would likely focus on any data stored/cached on remote servers. MailMate is a Desktop email application which only uses a local cache, but one could argue that moving emails to a different account (or even forwarding emails) gives MailMate “the ability to send Google user data from a Restricted Scope to remote servers” and then MailMate is a candidate for a “security assessment”. But I <em>think</em> this only makes sense if MailMate (Freron Software) stored anything on its own servers which I naturally do not do.</p>
<p dir="auto">Part of the problem is perhaps that the OAuth authentication flow is “too easy”, that is, evil (web)apps can easily ask for user permission to, e.g, access emails and if the user clicks Ok then that application can “quietly” fetch everything. Given that the user explicitly fetches MailMate to handle email then that doesn't really apply in my case.</p>
<p dir="auto">I don't really think that MailMate is the target of what Google is trying to stop, but that doesn't solve the problem of me being stuck in the verification process.</p>
<p dir="auto">The best protection provided is that Apple ensures that only releases created by me (with my secret developer certificate) will run on macOS without warnings. Something similar does not exist for OAuth. Anyone can create an application with a different developer certificate and then (mis-)use my verified Google OAuth registration -- including if I had to go through a security assessment to get it.</p>
<p dir="auto">I'm just thinking out loud here. Given that MailMate is a single-person business, consider the above what I would be discussing with colleagues at the coffee machine in the company office :-)</p>
<p dir="auto">-- <br>
Benny<br>
<a href="https://freron.com/become_a_mailmate_patron/" style="color:#3983C4">https://freron.com/become_a_mailmate_patron/</a></p>
</div>
</div>
</body>
</html>