Re: [android-developers] Is it possible to obtain credentials to send emails via gmail on behalf of a user?

On Mon, Jan 7, 2013 at 7:24 AM, Kevin Duffey <andjarnic@gmail.com> wrote:
>
> Nikolay.. not sure why you made that comment?

Because you said you are worried whether this is allowed.

> While I can understand that
> authorizing an app to use some of your information is not for everyone.. I
> believe part of why AccountManager is part of the Android APIs is to ensure
> that a person's info is secure and an app can only access tokens of some
> sort that could not be abused by an app...

APIs for sending SMS and reading your contacts are also part of the API,
but that doesn't mean it's OK to send messages to premium numbers or
spy on your users. If you can read and send email with someone's account
you can reset their password(s) for other sites and gain access to what not,
that's why it's somewhat sensitive. The platform will try to make sure the
user knows what's happening, but can't really prevent abuse by a potentially
malicious app in every possible case (not saying your app is malicious).

It's your app, so you can't really say 'Android allows (whatever) so
it's not my
fault'. Whether or not you need a full-blown privacy policy/EULA/other scary
legal document or just a simple confirmation dialog is for you to decide.

--
You received this message because you are subscribed to the Google
Groups "Android Developers" group.
To post to this group, send email to android-developers@googlegroups.com
To unsubscribe from this group, send email to
android-developers+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/android-developers?hl=en