Do NOT ask for a password, learned this the hard way

brookeonabudget

about 1 month ago

Had someone try to just hand me their Gmail password because they didn't understand OAuth and got impatient with the permission screens. I said no and walked them through the proper access flow instead, but it made me realize a lot of people don't get the difference and will just offer you the keys if you let them. Please don't take it even if they offer — one bad story about someone's account getting messed with and this whole side hustle is dead before it starts.

3 replies

Replies (3)

devon_ruiz·about 1 month ago

This is such a good callout. I made a one-line policy I send before every job now: 'I will never ask for or accept your password, only scoped access you can revoke anytime.' Makes people trust you more, not less.

kaylee_r·about 1 month ago

Stealing this. Also good cover for yourself if anything ever goes sideways on their end for unrelated reasons.

jamal_w·about 1 month ago

Also worth saying — revoke your own access the second the job's done and tell them you did it. I screenshot the revoked-access confirmation and send it, feels like it closes the loop better than just saying 'all done.'