-1

I'm making a project for school where I will be using PHP to allow my users to log in to their email account using PHPMailer to receive/send emails.

The purpose is that I will be providing an encryption service.

But that means that they will have to send their password to my server, and my PHP script will be accessing their emails and sending/receiving them back to them after processing.

It's a school project so I will be doing it anyway on a local XAMPP setup for the project. But I was wondering if I could make the service public.

My question is, do I risk being sued by, ie Google, if I enabled Gmail users to use my service?

After all it is legal to distribute an email client. The part that has me worried is that my server will be acting as a proxy and will at one point receive their password (although it will not be stored).

(I know I could setup my own email server for this, but the idea would be to let users use their current email addresses)

EDIT I plan on using HTTPS to avoid having plain text passwords flying around.

3
  • Totally off topic. If you're not sure about this, don't do it. Learn more first.
    – Dave
    Sep 25, 2013 at 11:41
  • This question appears to be off-topic because it is about legal problems. Please consult a lawyer if unsure.
    – slhck
    Sep 25, 2013 at 11:48
  • @user2018084 - Google provides ways to access your account. You can access their account through POP3 and their Google API. While its a school project there are several MAJOR problems with your idea. Encrypting email is sort of pointless if you are worried about privacy, given that, the email header will be in plain text. Otherwise PGP is the best worst solution to making the contents of an email secure. You do understand this service basically means you will be able to read the user's email right?
    – Ramhound
    Sep 25, 2013 at 11:49

1 Answer 1

3

No, there's no legal problem in being a user's mail client. The e-mail belongs to the USER, not to the hosting provider, and the user can access it with whatever compatible client they like.

That said, I'm pretty sure I wouldn't even consider using a web-based encryption service that wasn't from my hosting provider. Using a third-party service to read my e-mail means that not only do I have to worry about my provider leaking my information, I have to worry about this other service leaking my information.

I can't think of any way that anyone would appear trustworthy enough for me to double my exposure like that, when I can run an encrypting e-mail client on my desktop or my phone and at least have some control.

Not the answer you're looking for? Browse other questions tagged .