Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

How can I know if an app of an unknown author (like gTasks) is reliable for me to give my mail password to use it?

share|improve this question
    
Obtaining the app from (Mac) App Store, as you linked, significantly lowers the probability of shady actions. –  koiyu Dec 5 '11 at 19:11
add comment

4 Answers 4

up vote 8 down vote accepted
+50

You have to trust the developer of the app. Period.

Besides code analysis there is no way to eliminate the possibility that an app does send your password somewhere.

And even tools like Little Snitch won't help you if the app is allowed to send emails from your account. If you send an email to somebody it would just use the established connection to afterwards send another email with your password. Since the connection is encrypted you can't see what the app is doing. And because the whole purpose of the app is sending emails the connection is not suspicious at all. Same thing is true for all apps that need access to the internet, if you enter the password to an facebook app it could just use facebook to send a private message with your password and so on.

To make it even more difficult to detect, the developer could implement it in a way that the malicious routine waits 30 days before it sends your password. And if the developer is a smart criminal (he wrote a great app so he probably is) he can detect testers who just fast forward their device date setting too.
If the developer is smart it is nearly impossible to figure such things out without looking at the code.

Entering your password somewhere is all about trust.
And with all those apps from unknown developers it's hard to figure out which app you can trust enough to give it your password.
That's the reason Twitter, among others, uses an authentication process where the app never knows your password.

Having a different password for different services helps in case you have accidentally trusted an untrustworthy developer.
But your email password is a little bit special because usually it can be used to gain access to almost all services you use.

share|improve this answer
add comment

I'd do the following: use two step authentication in Google, create a password specifically for the app, and then from this page you can check the last time that certain password has been used. If it always correspond to your last gTask usage, then you should be safe.

If that's not the case, you can revoke the password from there.

Note: with this method the developer could read your mail anyway, so better be safe than sorry. However you could create a dummy account and see whether that gets hacked.

share|improve this answer
    
However, this only answers the specific example given in the general question. –  koiyu Dec 5 '11 at 11:26
    
For the case of apps that need your mail password, that's the best answer to that general question. The issue of trusting your mail password comes up often enough that they have a separate way to authenticating for it, so that's clear evidence that this example is widespread enough that they implemented two-step authentication and application-specific passwords. So yes, it's specifically answers the specific question regarding mail passwords which is a specific enough situation that a specific different solution is available for it. –  TJ Luoma Dec 7 '11 at 17:45
add comment

Something like a Little Snitch will help you to determine if app creates any outbound connection besides obvious connection to Google servers.

It still possible for the app to just send your data to google account of rough developer but I don't have idea how to check that.

share|improve this answer
add comment

If you are not sure about an application search google for reviews or at least a website. If a lot of people complain you wil know not to download the application.

In general you can't trust anyone with your details and it is best to keep them as much as possible to yourself. If you do have to give out your details, make sure you use a different password each time. It will be hard to remember all your passwords, but it also keeps your accounts such as your email or facebook safe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.