Gmail Delegation Feature Leaves User's Inbox Vulnerable

Computer Science graduate Digvijay recently discovered that someone still had full access to his Gmail account, allowing them to read and send emails from his inbox.

This was surprising because he had changed his password and enabled two-factor authentication. However, the delegation feature in Gmail's settings allowed his friend to have direct access to his inbox without needing a password or going through Google's security checkup.

Delegation is separate from the usual permissions granted to third-party apps that connect to your account, and it allows up to 10 delegates on a personal account. Digvijay had added his friend as a delegate years ago when they worked together on a WordPress site, but he forgot about this setting and didn't remove it.

The delegation feature doesn't expire or get affected by password changes, so Digvijay's friend still had access even after he updated his account security. Google also doesn't notify you when someone with delegation access opens your inbox.