Hacker News Reader

Comment by jamieweb | Hacker News Reader

Looks interesting...

It took me a bit of time to find out how it actually works, as the 'How it works' button doesn't actually tell me how it works. I had to click onto the FAQ in order to find out that it integrates with Gmail.

Unfortunately I will never be giving a third-party access to my inbox like that. I was hoping that this service would be something where you can forward a spam email and they visit the unsubscribe link for you, or you simply paste in an unsubscribe link and it handles it all.

Perhaps these suggestions could be added as extra features for those of us who want to unsubscribe without giving away access to our inboxes?

Currently my personal process for unsubscribing is to either put the unsubscribe link into urlscan.io, and if that doesn't work (e.g. if it requires a complex form input), then I forward it to a malware sandbox machine and do it there.

View on HN

I understand the privacy concerns, but for me, if I'm prepared to outsource my email to Google then how different is it to let other SaaS scan my inbox to provide their service (I accept size is one factor).

The Privacy Policy of Leave Me Alone is pretty clear on their respect for my data (not selling it).

If they don't respect this policy, it's going to get found out eventually, and it's going to hurt their business and their future reputation as founders.

Their incentives are in the right place to behave in the way that they've stated.

Security could be a concern as well, but it's all done within the framework that Google has created. Tokens can be revoked (if one desires, immediately).

Which just leaves the servers being compromised before/during the interaction. This isn't impossible and is something that LeaveMeAlone should definitely be considering. However, A breach potentially means the end of their business. This makes me trust, again, that their incentives are in preventing this from happening and investing in hardening the servers (etc).

> if I'm prepared to outsource my email to Google then how different is it to let other SaaS scan my inbox to provide their service...If they don't respect this policy, it's going to get found out eventually, and it's going to hurt their business and their future reputation as founders.

The likelihood that some small SaaS shop will be found out for unethical/illegal behavior is much smaller than Google being found out. It does look like their hearts are in the right place, for what it's worth. But there's no way for them to promise never to sell to someone interested in monetizing the data.

Thanks for the kind words.

I think the only way we can make this promise is by doing what we're doing right now and not actually storing any email content.

I'm not sure the best way to prove that this is what we're doing, short of open sourcing the code, so I'm open to suggestions there!

I totally understand this difficulty. My startup's browser plugin [1] changes text appearance to make reading on-screen easier, and this obviously requires the ability to "view and change content on all sites you browse". I'm sure this permission request scares off some people, but we've not had too much trouble with it.

We make it clear in our privacy policy that we don't tie any usage information to user accounts, ever. I think it also helps that we have awards from social-good type organizations like the United Nations, NewSchools Venture Fund, and Stanford. (OTOH, given the leaked emails from the Stanford-based founder of Snapchat, maybe that last one hurts more than it helps....)

1: http://www.beelinereader.com/

It would be interesting if you could define a restricted-API for email, with just enough functionality to provide your service. The issues right now is that there is no fine-grained way to grant permission to ones email, it's all or nothing.

Of course, it might take a long time for email providers to offer such restricted-API access, if ever. As a stop gap, you could offer an open-source daemon your users could self-host. It would act as a gateway, granting you limited access to their email, without you needing their password or cart-blanche permissions.

Hold public audits by a trusted 3rd party to show you are not keeping any data - on a repeating basis (6 months?)

We're already required to perform an audit by Google every 12 months (I've mentioned the requirements of this below, but it basically amounts to the same thing), would this be acceptable?

What are the details of this? I've seen how things work on the Chrome Store side, and it's completely haphazard. There isn't an official audit schedule, as far as I can tell, but like with the iOS App Store, they do sometimes decide to flag/remove an extension for completely bogus reasons, with little/no notice: https://medium.com/@BeeLineReader/google-yanked-my-chrome-ex...

As of this year with apps that access the Gmail API it is an official audit by an authorised third party assessor.

More info here: https://cloud.google.com/blog/products/g-suite/elevating-use...

That's great. I'd emphasize this both in the privacy policy and in the FAQ. It's not bulletproof, but it goes a long way.

I like the forwarding idea, not only because of privacy issues but also because I can easily forward emails from account types they don't support.

That's a really nice idea, and would be easy for us to implement. I love it. I'll add it to our roadmap right now.

Sounds good, and it would be perfect if you could make the 'How it works' button point to somewhere that explains the Gmail integration right off the bat, rather than buried a bit. :)

Yes, we will definitely do this as well.

Reply on news.ycombinator.com