Scan to Google Drive requesting too broad permissions

[jgreger]

I was setting up scan to Google drive on my new printer today and found some concerning security settings. Is there any reason why the eStorage app used to scan to Google drive is requesting Full Access?

This seems like an extreme overstep of permissions actually needed in order to scan to drive and opens a rather large security risk.

The relevant access scope being requested:

https://www.googleapis.com/auth/drive Full, permissive scope to access all of a user's files, excluding the Application Data folder. Request this scope only when it is strictly necessary.

As per Google authentication guidelines here: https://developers.google.com/drive/api/v3/about-auth an app developer should "choose the most restrictive scope possible, and avoid requesting scopes that your app does not actually need."

From my prespective, the eStorage app should only need the following permissions:

https://www.googleapis.com/auth/drive.file

Per-file access to files created or opened by the app. File authorization is granted on a per-user basis and is revoked when the user deauthorizes the app.

and maybe 

https://www.googleapis.com/auth/drive.readonly Allows read-only access to file metadata and file content

Could someone shed some light on how HP can change the access scopes to improve the security posture for this service?

Thanks!

[banhien]

@jgreger

Google Drive (from Google, not HP) requires user's priviledges to be able to write.  You can ask Google why, similar to scan to email using Google mail (ie gmail) you have to setup few more steps to pass security rules.

Regards.

[jgreger]

Yes, the eStorage app needs write permissions. I have no issue with that, it wouldn't work otherwise.

I have issue that the eStorage app is requesting FULL ACCESS. Ie, it can read/write/DELETE absoltely ANY file in my drive. I don't see why a scanning app would require this level of access.

As I mentioned earlier, there is a permission role that would grant the app read/write access to only the files the eStorage app creates. This, in my opition, is more suited to a scanning app

[vpradeep]

+1 to @Jgreger's question

Also, I strongly disagree with @Banhein's response.  Google Drive provides finer grained permissions options than what @Banhein suggests in his response.

Looking at the previously provided Google Auth docs linked in this thread (https://developers.google.com/drive/api/v3/about-auth), the following permission is needed:

https://www.googleapis.com/auth/drive.file

"Per-file access to files created or opened by the app. File authorization is granted on a per-user basis and is revoked when the user deauthorizes the app."

There is no reason that HP needs read/write access to all of my Google Drive files.  This is a huge privacy oversight.