G-Archiver Scam?
Coding Horror reports that Gmail backup software G-Archiver emails the user name and password of users to the apparent creator, John Terry. Dustin Brooks, who reverse-engineered the software and found the creator's user name and password, was shocked to see 1,777 …
Context & Ripple Effects
Gmail credential security was already under scrutiny heading into March 2008: months earlier, The Register flagged a surprise password-cracking function in Google's own services, followed by Guardian Unlimited reporting that Google could effectively recover forgotten passwords for accounts — an uncomfortable capability for a service whose popularity among students had driven college-wide adoption of Google Apps Education Edition.
Against that backdrop, Coding Horror's report lands on the weakest link in the chain: not Google itself, but the third-party tooling built on top of Gmail. Reverse-engineer Dustin Brooks found that G-Archiver, a paid Gmail backup utility, transmits each user's account name and password to the developer's own inbox — he reportedly pulled up roughly 1,777 harvested credentials from the creator John Terry's account, a detail that turned a niche utility review into a story about blind trust in small software vendors.
First-order effects
- Anyone who has run G-Archiver has handed their Gmail username and password to the software's creator, meaning affected users need to change their credentials immediately and assume their mailbox contents were readable.
Second-order effects
- The incident puts every small third-party Gmail backup and migration tool under suspicion — buyers will demand verifiable credential handling or open-source alternatives before granting full mailbox access again.
Third-order effects
- If utilities keep harvesting credentials this way, the pattern pushes toward platform-level authorization (scoped tokens rather than raw passwords) as the only defensible way for third-party apps to touch webmail accounts.
The trend: As webmail becomes the primary personal archive, third-party access tools shift from asking users to surrender their password toward scoped, revocable authorization.