Gmail Backup Utility G-Archiver Comes Under Scrutiny

G-Archiver, a $30 program that can backup a Gmail account to a local PC hard disk, has come under fire recently after accusations have been leveled that the program actually collects Gmail usernames and passwords - something end users might not want to share with the company.

Concerns over G-Archiver, which is distributed by software publisher MateMedia, came to light when a blogger Jeff Attwood posted excerpts of an e-mail from a computer software programmer who felt he was duped by G-Archiver into handing over his Gmail username and password to the program's author.

According to Attwood's blog post at Coding Horror in order to use G-Archiver you must submit your Gmail username and password to G-Archiver. This, Attwood feels, is a "completely malicious violation of people's trust."

Does G-Archiver Really Need My Private Info?

To me it's unclear why G-Archiver would need my Gmail account information to work. Perhaps there is a legitimate reason. However, after reading G-Archiver's end user license agreement I don't see any details revealing it collects this information. When you install the program and run it G-Archiver prompts you for your Gmail user name and password. Again, it doesn't ever discloses that it collects and stores this information.

It's chilling to think what someone could do with a Gmail account information considering how many Gmail services are offered now (Google Apps, Search History, and Google checkout). It's important to consider for a second that it's possible that the G-Archiver thought it needed the Gmail login information for some harmless reason. I don't know.

Either way concern over G-Archiver raise bigger questions about how Web services will work together (or not) in the future. There are many security issues that surround collaborative Web services and software that "talk" to each other. Everyday I sign-on to the Web-based communication service Meebo I hand over my third-party IM username and password. Should I be worried about that also?

In this day and age where it makes more and more sense for Web and software apps to work together using open application programming interfaces there need to be more rules and disclosure about how personal information is shared between companies.

If you've used G-Archiver and don't want a third party having your Gmail username and password you might want to change your Gmail password. To avoid situations like this in the future do extra careful homework on the company you are downloading third-party applications from.

Comments

Two points:
1. How is any app supposed to back up your web mail without logging into the account?

2. Why didn't you post all of the relevant details - the issue was not that it asked for the password, but that it EMAILED IT TO THE PROGRAMS AUTHOR!

aep528

March 10, 2008

4:10 PM PT