Re:What Thunderbird Learned at FOSDEM
by Arnt on Friday February 09, 2018 @10:14AM
(#16340730)
SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead client stores an app-specific password-like string instead, one with limited rights), which is a big improvement IMNSHO.
[ Parent
| on HN ]
Re:What Thunderbird Learned at FOSDEM
by jimktrains2 on Friday February 09, 2018 @10:32AM
(#16340864)
Which is different from XOAUTH2. The "less secure apps" listed in google still list ones using app-specific passwords.
If you look at how, e.g. Fastmail solves this[0] (and other services do the same or similar), it's a nice example of something that's both secure and supports any client without requiring the client to do anything specific to their service.
[0] https://www.fastmail.com/help/clients/apppassword.html?u=069...
Replying to cvwright:
That feature is presented by Google as an alternative "for less secure apps". If you're using a client that Google considers to be "less secure", you also have to explicitly enable support for "less secure apps" in settings, in addition to that. This setting may not even be available to you if you're not on @gmail.com and your domain administrator has disabled it (which Google recommends they do).
From the Github issue linked above, apparently Google supports something similar: https://support.google.com/accounts/answer/185833