4 ms·
"Less secure login" is just a scare tactic anyway. You're still using a device-specific, highly-random password that's being sent over TLS to their servers. I
by mi100hael 9y ago
"Less secure login" is just a scare tactic anyway. You're still using a device-specific, highly-random password that's being sent over TLS to their servers. It's at least as secure as any other IMAP/SMTP server on the internet.
- mikelward 9y agoBut it's not device-specific, which is exactly what makes it less secure. If anybody is able to sniff your password (e.g. due to initially trying to connect without TLS accidentally) or MITM your connection or get privileged access to your device (either locally or remotely), then they get access to your email, even from their machines.
- mi100hael 9y agoAny mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connection is MITM'd and you accept the bad certificate error or your laptop is totally pwnd, you're screwed regardless of how you're authenticating. In those situations an attacker could still hijack sessions, exfil data, act on your behalf, etc regardless of whether you went through their browser auth flow with MFA.