Re: getmail-gmail-xoauth-tokens patch 1

Tyrel McQueen <[email protected]> wrote:
> 
> This is the first of two potential patches for the oauth2 support script of
> getmail. If one creates an OAuth2 client_id that is of type webapp, then
> two additional parameters need to be passed in order to receive not just an
> access_token, but also a refresh_token. The patch below accomplishes that.

Thank you for the patch!

> Another patch for this script is necessary to make it work as of the end of
> February as well. As outlined in:
> 
> https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html

Oh ffs.  "Out of band method poses a remote phishing risk" -- *everything*
poses a remote phishing risk.  If you can convince a victim to provide you
arbitrary information over the phone etc, it's game over for that user, no
matter what the app does.

> The out-of-band access mechanism is no longer allowed. This means this
> script needs to be updated so that instead of having the verification code
> pasted manually, that it starts a mini http server on localhost, and then
> sets redirect_uri appropriately to receive the code by a redirect to
> localhost:

Yes, I don't see any other alternatives to that method.  It's particularly
stupid.

Google/Gmail, the 900lb gorilla of email today, is constantly pulling bullshit
like this, deliberately trying to make using any other email
client/system/provider have more friction than "screw it, I'll just use
Gmail".

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------