alt Hacker NewsI mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped.
An app password is basically just an API token, it's up to the backend what powers it grants.
I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped.
An app password is basically just an API token, it's up to the backend what powers it grants.
API tokens are usually explicitly scoped by the user when they create them. I don't recall Google (or anyone else) ever exposing that when creating an app password, but maybe it was scoped down on first use?