techno.blog("Dion")

I couldn’t help but interrupt someone at the coffee shop as I saw them giving their Gmail username and password into some random third party system to “grab your contacts”.

I get why sites have been doing this, but now we have the Google Contacts API there shouldn’t be the need.

What astounded me was the logic that this fellow used. He talked about how he used really good, different passwords, and never kept them in his email, so if the third party site was malicious they wouldn’t get anything good.

He didn’t seem to realize that by giving away the key to your email account, you are doing a LOT more than letting someone look at that email to your mum. With it, they have the keys to your forgot password? life. They can quickly go to accounts that you have all over the shop, simulate a forgotten password use case, and now they DO have access to your account info.

It isn’t about what is in your email before hand, it is the access to future email that matters.

This is why I was over the moon when the contacts API saw the light of day, and I hope to see all providers do similar work.

I was really excited when I logged in to Gmail and saw the new settings:

I think this is my number one feature request for Gmail, so it is great to see it role out. Since Gmail is tag/label based, it isn’t as easy to implement IMAP as it may seem, so good job dev team!

The reason that I personally care is that I have been able to do this for my corporate account:

And now, I can finally do the same for my personal email account. Check out the automatic labels that you get.