Why are passwords needed for Migration?

One day I was interacting with a customer via email about their migration to Google Workspace, we at Googally try to provide as more information as we can to our customers so they understand how we’ll migrate them to Google Workspace, what would it need, how does the process look like etc, and we usually send this information as part of our initial quote to the customers.

However, this time, we got an email from a prospective customer asking ‘Hi, Why do you need my users’ passwords, is it safe’?

It is a great question which every individual and business should ask before handing over passwords to anyone, after all passwords are a key for something that has a value, it can be your bank locker, your email, your crm or any other account.

We will limit the scope of this article to sharing email passwords though as this is what our customers provide to us for migration from Godaddy, Rackspace , Office 365 and other email systems to Google Workspace.

So, Why does Googally (or any other data migration provider) ask for email passwords, and more importantly, is it safe?

We always prefer to not talk about technical jargon, but sometimes we need to go a bit technical to let our customers understand the rationale behind things.

So, first, let us talk about what goes behind the password:

1. You sign up for a software application, it asks you to create a new user account with your username and password.
   ‍
2. This password is saved in to the software vendor database (usually in hashed format instead of plain text to avoid any consequences if their database is attacked), think of it like your password Welcome123 would be hashed/converted to af1h3jht5j4rhujref#37744hjd before it gets saved in the database.

Now, let us about talk about Application Programming Interface (API) which helps two computers talk to each other (an example would be a computer which hosts your website and your CRM software, if you need an integration where when a form is filled up on your website, data should be sent and saved in your customer relationship management (CRM) software.

Now, this type of task is too painful to do manually, you can not have a person manually taking the form fill up data from your website, and then enter that in your CRM, and there comes API which is a backdoor to allow communication between two or more software applications.

These software systems would also need to authenticate you to verify that you own both the systems, and these systems usually authenticate you in either of the ways -:

1. Password (Key) - When making a call from one system to another, you would simply send a password / API Key to prove that you are who you say you are. This is considered less secure though, however some old systems still use it.
   
   
2. OAuth - Instead of sharing your password, you allow a system to act on your behalf and do certain things (e.g when you book a hotel, you don’t get access to all the rooms, only the room that is reserved for you). This is considered more secure. It also includes a concept of impersonation which allows you to take actions on behalf of your users (e.g as parents, we make certain decisions for our kids).
   

Some email systems provide impersonation functionality where you can impersonate other users in your domain or account and take actions on their behalf, e.g as an admin user, allowing an application to migrate data for all of your users without requiring their passwords.

However, some traditional and less secure systems still do not provide that functionality, and you would have to provide each users’ email (or user name) and password to the migration application.

You would find the following reference helpful.

Systems which support impersonation, and migration utilities would only need your Administrator user id and password :

• Rackspace Hosted Exchange
• Rackspace Office 365
• Godaddy Office 365
• Microsoft Office 365
• Microsoft Exchange Server
• Google Workspace

Systems which do not support impersonation, and migration utilities would need each users’ email address and password for data migration regardless of the migration vendor or utility being used:‍

• Rackspace Webmail
• Godaddy Webmail
• Zoho Mail
• Personal Gmail Account (@gmail.com)
• Any other IMAP only server which doesn’t support impersonation

‍
It is the technology limitation and migration vendors or utilities can not control it, so if you are migrating from Rackspace Webmail to Google Workspace, then regardless of the migration vendor or migration tool you use, you will have to provide each users’ email address and password as Rackspace Webmail only offers IMAP which doesn’t support impersonation.

Is it safe to share passwords?

You understand that sharing the users’ passwords in some cases (especially if you are migrating from a system that doesn’t support impersonation) will be required, and now your question should be Is it safe to share passwords?

Any migration vendor or utility will need the password in plain text (or unencrypted) because this is how they’ll authenticate to your email server, but you need to ensure that the channel you choose to share your users’ passwords with any migration vendor should be encrypted so these passwords are secure from any middleman between you and the migration services provider like Googally.

Here are the systems Googally may use to collect users’ passwords from you:

• Google Sheets : We use Google Sheets to collect data (e.g Server Credentials, User Credentials, DNS Credentials etc) as Google encrypts data in transit and at rest in Google Sheets. This Google Sheet will be explicity shared with you with your (gmail or google worskpace) email to ensure only you or the authorized individual can access the sheet.

‍

How are these passwords used in migration?

You understand that passwords are required in some cases, and you also understand the channels to securely share these passwords with us, but how do we use them during the migration process?

‍

We do not use these passwords to manually login to your mailboxes otherwise that would be insecure, painful, time consuming, we put these passwords in our migration utilities which then call your email server programmatically to fetch the data, and then put this data in your Google Workspace mailboxes via APIs (e.g Gmail API). You can learn more about our migration process here.

‍

Every migrated item (e.g email) is assigned a unique key to avoid any duplicates, and it also helps us report the migration progress and success rates.

‍

I hope you would have got some idea on why Googally (or any other migration service provider) would need your users passwords only in some cases because of the limitations imposed by your current email system.

‍

Please contact us if you have any additional questions around migration to Google Workspace.

‍