macOS wants access to your Google account

Funnily enough I agree with what you said.

I think the chances of someone wanting access to calendar but not gmail or vice versa are very small, but indeed feasible.

Yes ,Correct

Peter

Do you work for Apple? Your answers sound a bit off base to say the least. You obviously have something against google, but you are coming across as someone with authority, and I'm not sure that is the case. No offense intended, but I'm looking for a real answer, as this is a bit concerning.

No hijacking occurred. No personal attack occurred. You have offered an answer that "it is google's fault", however, most people don't think this is the case. Like others on here, I'm looking for a solution. Offering "I hate google" responses is not helpful in finding a solution to a potential security flaw in MacOSX asking for elevated / unnecessary privileges.

I can see you post a lot on this forum, and likely provide many good answers and help to people. I am sure it is appreciated.

I am not trying to attack you in any way. I know a bit about OAuth2 having implemented the same in many corporate environments.

It's Mac OS who is asking for OAuth2 authentication.

It's Mac OS that is asking for privileges it does not need.

These requested privileges Mac OS does not need should raise concerns to users. However, this is how Apple chose to integrate with the google OAuth2 API - requesting max privileges. Apple should review this policy.

In short, if you want to use gmail with Mac mail, you have no choice but to grant these privileges, or connect to gmail via standard iMap (which is less secure, although still encrypted).

Keep up the good work Peter.

It is a matter of security and whom one choses to trust. The less devices/parties with access to your data, the lower your attack vectors from potential attacks. Some choose to trust Apple over Google. That is a personal choice. Others choose Google as their preferred. In the end, the option should be up to the user, not to an entity.

Apple Store implements very strict policies on Apps to not request more access than they require for proper operation. They have not followed this same policy in Mac Mail integration to Gmail services. As a result, if you authorize the Gmail integration and your Mac is compromised, so is your info on Google. And if all you wanted to do was sync your calendars, this is a concern for any security minded person. This is a new integration for Mac OS, and they likely chose the quickest, most cost effective method by requesting full access. Apple can remedy this by requesting access to only the services the user has requested.

Because you are using the Mac to read and write your google assets.

Like I say, I dropped Google. I suggest you do the same if you don’t want to accept their T&C

It's Mac OS who is asking for OAuth2 authentication.

It's Mac OS that is asking for privileges it does not need.