[Android Apps and Games] UsernameShortage:
Spyware is the correct description

I found this thread on Google and registered to commend you on your foresight. And to preach, of course. ;)

I run my own email server for almost 20 years now, originally because I was never fond of the BOfH idly scrolling through my personal correspondence. Though in recent years this has seemingly become even more important. We're talking about an archive of thousands of emails, in part quite confidential or personal. Many years have I taken the greatest care to keep them safe.

I thought the apps name was strange, but since it had very high ratings (with Google hiding the negative ones) and did not mention anything "cloudy" in the description, I figured they're trying to sell some cloud email service attached to the app. Only on the second installation, when I was being clumsy with the setup and checked the server logs to see what's going on, did I realize that it is not my phone fetching these emails. It is not even CloudMagic inc. themselves - it is Amazon! (EC2) They do not have the slightest control over those passwords, because they have already passed them on!

Half my lifes uncensored history is now in the hands of a large corporation under a jurisdiction that grants a violent rogue government organisation access to it in total secrecy.

You, dear CloudMagic Inc., have with your corporate greed managed to achieve what nobody else has even come close to in all that time. Your app is such a blatantly bold trojan horse that I did not see it coming. You are truly nefarious.

My Twitter account was stolen.* You know how they got the password? From your's truly Sony. I bet they thought it was a remote scenario, too. So no, I don't agree. It did however just become a bit clearer why you are so carelessly risking the privacy of many thousand people. It's your arrogance.

As in handing them over to amazon out of convenience? Or by not telling people that you took them in the first place?

Let me reiterate to avoid any potential confusion: Any chance of keeping them safe has passed. You already gave them away. Voluntarily. Stop insulting your users intellect with preposterous claims!

I guess if a company branded "hostile to privacy"** ok's a completely different product then it must be allright.

Seriously. %^!$ you.

UPDATE:

Before posting this I uninstalled the app and changed all passwords last night. This morning I find over 600 failed login attempts from CloudMagic - for the account I never finished setting up, attempting to log in IMAPS with a plain text password. They don't even know what the word security means! First they hand all my data over to Amazon, then they literally spam my unencrypted password through the internet for no sensible reason whatsoever. If the server says the password is wrong, there is no point in retrying even once.

If it hadn't been 100% clear before, because it was a technical deduction, it is now proven that they store and have access to the plain text version of the the login credentials on Amazon EC2 instances. You know, this virtualization thingy where noone really knows which of the bazillion drives your data is really on. For all I know a careless techie could throw the data on a disposal truck on the next SMART warning. All claims of encryption are moot at this point, unless they have a room with 1000 monkeys entering the decryption keys from paper files on demand.

I don't know how accurate Google's Playstore stats are, but it seems that they posses over a million email accounts. That's a very yummy target for hackers and intelligence agencies alike.

* by spammers, because I deemed it about as unimportant as my Planetside account. No drama involved.

** by Privacy International