Re: [Imap-protocol] Seeking clarity on Gmail "Access for less secure apps" setting for non XOAuth2 access

Brandon Long wrote:
> I'm not really sure why the developer docs would link to the "how to
> avoid using this" support page... I guess I can suggest it.  I'm also
> not thrilled with the wording on that page, "latest security
> standards".

That's definitely confusing. Just talking about "less secure apps"
without specifying why do you consider them "less secure" is useless.
When I first read that page I thought it was refering to using a weak
ciphersuite in  TLS (for some definition of "weak").

(I did report it on the feedback form, but the page keeps the same
-other that now there is the «Allow less secure apps» option- )

You need to relate [1] with [2] in order to understand what it is
talking about
1-https://support.google.com/accounts/answer/6010255?hl=en
2-http://googleonlinesecurity.blogspot.de/2014/04/new-security-measures-will-affect-older.html



> 
> OAUTH2 is not ready for Thunderbird at this point, really, since you
> have to pre-register to get your client-id, and then also hard-code
> the various URLs for usage, as there is no auto-discovery yet either.
> Unfortunately, the bad guys aren't waiting for the standards to be
> written. Our abuse team is handling this, and so I'm not directly
> involved and don't know the specifics (...)
> 
I wonder what/how they are trying to fix. An application-specific
password can provide the same benefits as OAUTH2* -except for the
automatic refresh when it expires after 6 months- yet they are only
available with two-factor authentication.
* Although with a little more work from the user generating them. For
feature parity, instead of the program handing an identifying token, the
user would need to follow a Wizard and choose the MUA they are using
(with 'other' being unrestricted).

_______________________________________________
Imap-protocol mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-protocol