This is a feature, not a bug. Google comes up with ideas, sure, that doesn't mean all projects have to support it. There is nothing wrong with SSL IMAP auth.

> This is a feature, not a bug.

Fully agree. My point was that most users will disagree with you and I, or simply not really care to consider our argument. And that informs their choices.

Quote from the article:

> When I asked what that might look like the answers were uniformly along the lines of: “There is not a really good, open source, Email client on mobile...

People encountering issues with proprietary crap like Google's XOAUTH2 implementation could well be contributing to this view.

SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead client stores an app-specific password-like string instead, one with limited rights), which is a big improvement IMNSHO.

Which is different from XOAUTH2. The "less secure apps" listed in google still list ones using app-specific passwords.

If you look at how, e.g. Fastmail solves this[0] (and other services do the same or similar), it's a nice example of something that's both secure and supports any client without requiring the client to do anything specific to their service.

[0] https://www.fastmail.com/help/clients/apppassword.html?u=069...

Replying to cvwright:

That feature is presented by Google as an alternative "for less secure apps". If you're using a client that Google considers to be "less secure", you also have to explicitly enable support for "less secure apps" in settings, in addition to that. This setting may not even be available to you if you're not on @gmail.com and your domain administrator has disabled it (which Google recommends they do).

From the Github issue linked above, apparently Google supports something similar: https://support.google.com/accounts/answer/185833

Thunderbird doesn't support this either, does it. I thus don't see the relevance of this argument.

It does.