Malware – do not install

  • smerriman

    (@smerriman)


    1 month, 2 weeks ago

    The developers have confirmed that the only way to install the plugin gives them permission to delete all of your Google Ads campaigns and modify your billing information (to let them receive the income), even though this is an Analytics plugin.

    DO NOT INSTALL.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Michelle D.

    (@devmich)

    1 month ago

    Hi @smerriman,

    MonsterInsights is a documented Analytics product operating under Google’s policies. Our usage of granted permissions is bound by Google’s API Services User Data Policy and limited to the features publicly documented. Campaign deletion and billing modification are not among them.

    To learn more about the optional Google Ads feature or how permissions are used, please see the following:

    Thank you.

    Thread Starter smerriman

    (@smerriman)

    1 month ago

    I’m sorry, but that is completely false.

    Again, if you attempt to install MonsterInsights, you are required to grant MonsterInsights this permission.

    See, edit, create, and delete your Google Ads accounts and data..

    Emphasis on edit and delete. If you cannot edit and delete accounts and data, why does it say this?

    Clicking on learn more says (bold emphasis mine):

    This app wants permission to do anything you can do on your Google Ads account, including:

    See your performance data
    Create, edit, or delete your campaigns, ad groups, and ads
    Create, edit, or delete your bidding, targeting, and scheduling settings
    Set and change your budgets
    See, apply, and dismiss your recommendations
    Edit your billing settings

    If you cannot do any of these things, why does Google specifically tell me you will be able to?

    None of your post nor links on the website clarifies any of this at all, nor does the API policies page.

    If you are saying that it is Google who is providing inaccurate information, you should a) get them to fix, b) actually list all of the permissions from this message in your documentation page and explain why you will not in fact have permission to do what they say you can.

    • This reply was modified 1 month ago by smerriman.
    Thread Starter smerriman

    (@smerriman)

    1 month ago

    In fact, their API Services policy states:

    Permission requests should make sense to users, and should be limited to the critical information necessary to implement your application. <u>Don’t request access to information that you don’t need</u>.

    and:

    Request permissions in context where possible. Only request access to user data in context (via incremental auth) whenever you can, so that users understand why you need the data.

    Your permission requests appear to be much more than you need, don’t make sense to users, and are certainly not incremental – if I want to install Analytics tracking code, you are forcing Google Ads permissions, rather than only requesting them in context for those who want the Google Ads integration.

    And if it turns out Google’s description of the permissions are indeed correct, then you’re certainly failing this:

    Overall there should be no surprises for Google users: hidden features, services, or actions that are inconsistent with the marketed purpose of your application may lead Google to suspend your ability to access Google API Services.

    • This reply was modified 1 month ago by smerriman.
Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this review.