Hacker News new | ask | show | jobs
by hunter2_ 982 days ago
Would the terms established by Google, agreed to by a developer creating an integration like this, include a need to respect permissions unless the user explicitly requests (or is explicitly informed of) additional access for parties beyond those already granted access by Google's system directly? If so, it seems like this could be reported to Google who would pull it down and force Slack to comply, if Slack doesn't want to on their own.

I suppose the installation of the integration already involves a Google-served message along the lines of "Slack will be able to see everything as you do" but that's not quite explicit enough for a user to then extrapolate "...and may share it however they like without telling you." Like of course they could, but they shouldn't, unless it's super clear, and it's not.
1 comments
btown 982 days ago
https://developers.google.com/terms/api-services-user-data-p... is somewhat ambiguous on this front:

> Limit your use of data to providing or improving user-facing features that are prominent in the requesting application's user interface;

> Don't allow humans to read the data, unless: You first obtained the user's affirmative agreement to view specific messages, files, or other data, with the limited exception of use cases approved by Google under additional terms applicable to the Nest Device Access program...

Did Slack make it clear to the user sharing their Drive link that the preview isn't just visible to them, but to anyone in the channel or who has access to the link? Was that clear enough to be affirmative agreement? Is the little area where the preview is shown while you're composing a Slack message prominent enough to display that it will include a screenshot of the data?

Clearly, Slack thinks the answer to all these questions is yes, and Google either agrees or isn't enforcing their guidelines here.

(...As an unrelated point, the fact that the Nest Device Access guidelines are an explicit exception to even this modicum of user visibility, that the guidelines aren't linked, and can be unilaterally changed by Google without notification to users is... well, why I don't own Nest devices.)

link