4 ms·
Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose. What this mea
by tobyjsullivan 10y ago
Depends on your underlying email service provider. If it is gmail, for example, then they provide one-time use passwords for exactly his purpose.
What this means is if you enable 2FA for your gmail account, you can generate a one-time password to authorize any client which does not support a 2FA auth flow. This password is then destroyed by both parties.
If you run your own email server, I think you are at low risk of being attacked in a more general phishing net. An attacker targeting you personally still has many options but that is much less likely.
- sly010 10y ago> This password is then destroyed by both parties. I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?
- zeroxfe 10y agoSome IMAP providers like Gmail use a more sophisticated auth mechanism where a secret token is shared over the encrypted link after the first password auth. This token typically has a long lifetime and is used for future sessions.
- BrandoElFollito 10y agoI have never heard of that, do you have any sources?