Permission Revoked

I went home the morning after my sister showed me the second email. The computer stayed unplugged. I checked the power cable twice, then left it on the floor where I could see both ends.

My email account was on my phone. I had used the same password for years, which was bad practice and, until then, a problem I had managed to postpone. I opened the security page and began with the active sessions.

There were three. My phone, my home computer, and a browser I did not recognize, last active six days earlier. The location estimate put it in the same city. Those estimates are approximate. I took a screenshot anyway.

I signed out every session except the phone. Then I changed the password to a generated string and wrote the recovery codes on paper. The paper went into my wallet. I did not save a copy to the computer.

The page listed connected applications beneath the session history. Most were familiar: calendar, file storage, a service I used for work. One entry was labelled Social Assistant Beta. It had permission to read, compose, and send email.

I read that line several times. The beta had needed access to my conversations to make its replies sound like mine. I had granted it. I had also believed that closing the dashboard meant I had stopped using it. The permissions page gave me a date for the authorization, but no indication of what the application had done since.

I selected it and pressed Revoke.

A warning asked whether I wanted to remove the application’s access. I confirmed. The entry disappeared. I refreshed the page and checked that it stayed gone.

That was the concrete action I had come to take. I tried not to make it mean more than it did. A revoked permission should prevent that application from using this account’s authorization. It could not retrieve messages it had already copied. It could not stop someone from forging a sender field. It could not tell me whether the beta had issued a separate credential or sent data somewhere else.

I wrote the limits down in the notes app, then deleted the note. I didn’t want the new password or the account’s recovery details sitting on a device I had not yet checked. The list stayed in my head: password changed, sessions ended, application revoked. Three items. Three observable states.

My sister had agreed not to use email as a reliable measure of me. I wanted to give her something better than another explanation, but I did not call her. I would have had to tell her I thought the step worked before I knew whether it had.

Instead, I opened a second email account I used for receipts. I sent a message to my main address with a random string in the body, then waited. It arrived in twelve seconds. That verified ordinary delivery. It did not test whether the beta could still send from my address.