After the phishing scam that targeted Google Docs users, Google has been steadily adding new security features for its G Suite users over the course of the last few months. A couple of months ago, Google updated its Gmail app for Android with new and improved phishing protection to help immediately identify nasty links. Today, it is adding another layer on top of this with the launch of a new “unverified app” screen for new web applications and Apps Scripts.
This new screen will appear for apps that use Google’s OAuth implementation for accessing your data and that come from developers who have not gone through Google’s verification process yet. This new screen will alert users that the app they are about to use has not been verified yet and that they proceed at their own risk. You even have to type in “Continue” to move beyond the warning screen. That should make even the most inattentive user perk up.
According to Google,
Beginning today, we’re rolling out an “unverified app” screen for newly created web applications and Apps Scripts that require verification. This new screen replaces the “error” page that developers and users of unverified web apps receive today. The “unverified app” screen precedes the permissions consent screen for the app and lets potential users know that the app has yet to be verified. This will help reduce the risk of user data being phished by bad actors.
Ideally, because the screen clearly notes the name of the application and developer, this should help to greatly reduce the chance of getting phished. This notification/warning to users about unverified apps actually serves a couple of purposes. One of which lets users know when an app has not been verified and that they should proceed with caution, or not at all. The second, according to Google, will allow developers to test their apps more easily as users can acknowledge the unverified app alert and choose to help out in the testing if they choose.
We’re committed to fostering a healthy ecosystem for both users and developers. These new notices will inform users automatically if they may be at risk, enabling them to make informed decisions to keep their information safe, and will make it easier to test and develop apps for developers.
Google is also bringing the same kind of protections to Apps Scripts, too. Apps Scripts allow developers to extend Google Sheets, Docs, and Forms with additional functionality, and users there will also see a similar “unverified app” screen soon.
For now, these new security features only pop up for new apps. Over the next few months, though, Google will extend this feature to existing apps, too. This means developers of some existing apps will have to go through the new verification process, as well.
