Re: Pragmatic workaround to "less secure" authorization restrictions?

Hi Brett - thanks very much for the perspective and confirmation that 
moving to OAuth2 is the first step forward. I'm sure my users will enjoy 
the many other benefits that come with moving to OAuth2.

Daniel

On Sunday, January 4, 2015 8:13:13 PM UTC-5, Brett Morgan wrote:
>
> Hi Daniel,
>
> Please upgrade to OAuth2 sooner rather than later. The user consent flow 
> is required to inform the user as to what permissions your application is 
> requesting against their account, and thus needs to be shown. It is also 
> the place where 2nd factor authentication is handled. Given I have 2FA 
> turned on for my account, I can't set my account to enable "less secure" 
> apps. 
>
> I think upgrading to OAuth2 is a more pressing requirement than migrating 
> from Blogger API v2 to v3. =)
>
> brett
>
> On Mon Jan 05 2015 at 11:34:25 AM Daniel Jalkut <[email protected] 
> <javascript:>> wrote:
>
>> I am the developer of MarsEdit, a popular Mac blogging app that includes 
>> support for Blogger.
>>
>> Because MarsEdit has been around for a long time, it happens to still use 
>> The Blogger v2 GData API, and uses ClientLogin for authorization. I 
>> understand that moving to both the v3 API and to OAuth 2.0 for 
>> authorization is advised.
>>
>> In the mean time, however, I am facing the problem that users are having 
>> requests from MarsEdit rejected because of the use of "less secure" 
>> authorization method. In order to continue using MarsEdit, they need to 
>> turn on support for "less secure" mode in their Google settings. I can 
>> easily understand how this is off-putting to most users.
>>
>> So, I'd like to adopt a "more secure" authorization method ASAP, ideally 
>> before taking the time to move to the v3 API.
>>
>> It appears that I can use the OAuth 2.0 (or 1.0 for that matter) API in 
>> conjunction with the v2 API, so that might be the way forward.
>>
>> Is there any way to use Google's OAuth 2.0 or 1.0 authorization API to 
>> log a user in without the explicit "user consent" phase? Something akin to 
>> Twitter and Tumblr's "xAuth" which allows a one-time exchange of username 
>> and password for a persistent token? I suspect the answer is no, but I 
>> thought I would ask so I can adopt the most pragmatic solution ASAP. The 
>> longer solution of adding full support for OAuth 2.0 (with GUI user 
>> consent) will obviously take longer.
>>
>> Thanks for your help and advise!
>>
>> Daniel
>>
>>  -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Blogger Developer Group" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to [email protected] <javascript:>.
>> To post to this group, send email to [email protected] 
>> <javascript:>.
>> Visit this group at http://groups.google.com/group/bloggerdev.
>> For more options, visit https://groups.google.com/d/optout.
>>
>

-- 
You received this message because you are subscribed to the Google Groups "Blogger Developer Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/bloggerdev.
For more options, visit https://groups.google.com/d/optout.