Re: the great Gmail ERR [AUTH] therad

Charles Cazabon wrote:
> Neil R. Ormos wrote:
>> Charles Cazabon wrote:

>>> Overall, it would be much simpler -- it's
>>> really easy, just a few clicks -- for you to
>>> enable 2FA on your Google account and set an
>>> app password to use with getmail.

>>> It literally is a 10-second task.

>> The problem is that I do not want the effects
>> of turning on Google's Two-Step Verification.

>> In particular, I don't want my access to Gmail
>> or anything else to be dependent on Google's
>> capricious verification challenges that require
>> me to have a phone that is charged, active on a
>> WLAN or mobile network, and within physical
>> reach, with absolutely no recourse if the phone
>> is not available.

> You don't actually need connectivity; they
> support standard TOTP, so you can install any
> authenticator app (not just Google's) and it
> will work, without 'net access.  You do still
> need a device -- any device, not just a phone --
> for authentication, of course.  Well,
> technically you could actually do this with a
> calculator or pencil and paper if you're that
> desperate :)

> But this does seem kind of academic.  If you do
> not have a working computer, phone, tablet or
> other electronic device with working internet
> access ... what exactly would you be doing that
> would require you to interact with Google's
> authentication demands?  Are you using IP over
> avian carrier?

The user might have a working computer or a
working phone, with network access, but not
necessarily both, or not necessarily
simultaneously.

I'm concerned about a number of scenarios where
the user has access to a computer connected to the
public Internet but for some reason, no access to
their phone or the phone can't access the
Internet.  Maybe the phone has been stolen, or it
broke, or the battery is dead, or the phone was
left in the car, or is forbidden in the space, or
there's no network with which it will work.

I have been challenged by Google for verification
a couple of times while traveling with limited
access to a phone or network, and there was no way
to request that verification be conducted via a
recovery e-mail or any other way.  No working
phone, no access.

I understand Google is said to support TOTP.
OTOH, Google's caprice knows no bounds, so even if
an account is set up for TOTP 2FV, it's not clear
to me that there won't be an
authentication/verification challenge that can be
satisfied only via some other path, such as a
network-connected mobile phone.  It seems to be
the First Commandment in some in computer security
circles that users may have no expectations of
consistent or predictable authentication behavior
and that the behavior shall be arbitrarily varied
so as to frustrate any expectation that users may
develop.

> Note: I am not trying to justify Google's
> policies, procedures, or applications.  Just
> trying to help.

>> Another problem with reliance on app passwords
>> is that if the user changes their Google
>> account password, all the app passwords are
>> invalidated.

> Yes, but that was also the case with using your
> login password for email.

Even so, the same password works (well, heretofore
worked) in all the places where it would be
stored, could be chosen by the user so it could be
easily remembered, and whether a stored password
was the old one or the new one was instantly
apparent.  Not so with application passwords that
look like a strings of random characters.

I'm interested in OAUTH2 support not because I
think it's objectively better security, but
because, when the OAUTH2 stuff is built into an
app, using it results in the lowest user
authentication friction.  I understand I'll have
to wait for someone to contribute a patch.