Normally when working with a user's credentials, I would store them locally on a device, never on a server because it creates unnecessary liability.

For example, on iPhone we have

  • Mail (default)
  • Gmail by Google
  • Spark by Readdle

I spoke to Google Apps support today and they say that all authentication credentials when using their app are stored locally for their Gmail accounts. I am not sure how the Apple default mail client stores credentials, input would be appreciated! Spark on the other hand says that their “server needs to check and send emails from your email account for [some function's] to work. And to achieve this, we need to store your email account’s access token.” Full story here.

Now I am curious

  1. Do they really need to store my credentials on their server on iPhone, if so; is this due to iPhone only or would this be Android as well?
  2. I have two factor enabled and an app password, is the app password what they would store? Is this my OAuth token in this case?
  3. This seems like a great degree of trust that I have to put into a 3rd party application and that their server's don't get hacked?

Thank you very much, if I did not post in the right group; i sincerely apologize, Please point me in the right direction and I will delete this post.

How do 3rd party mobile mail clients work?

  • SuperUser help center is clear such questions are off-topic here. – techraf Aug 22 '16 at 5:06
  • @techraf okay, where should i ask then? It's a general information security question related to mobile authentication with oauth. I couldn't find any on stack exchange. – JordanGS Aug 22 '16 at 13:42
  • This question is off topic here and cannot be answered anywhere on any of the Stack Exchange sites since you are asking a question about how software works that can only be solidly answered by the software manufacturer. In general, all email clients store credentials locally on a device. An “access token” is not credentials. If you are concerned about how Spark works, contact them for clarification. Past that, you might simply be overthinking all of this. – JakeGould Sep 10 '16 at 6:45

This is not exactly an answer, but it looks like the question was cross-posted and there are answers here: https://security.stackexchange.com/questions/134627/3rd-party-mail-clients-on-iphone-android-and-credential-storage

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.