5 ms·

This is a feature, not a bug. Google comes up with ideas, sure, that doesn't mean all projects have to support it. There is nothing wrong with SSL IMAP auth.

by pmlnr 9y ago

Arnt 9y ago
SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead client stores an app-specific password-like string instead, one with limited rights), which is a big improvement IMNSHO.
- jimktrains2 9y ago
  Which is different from XOAUTH2. The "less secure apps" listed in google still list ones using app-specific passwords.
- lucideer 9y ago
  If you look at how, e.g. Fastmail solves this[0] (and other services do the same or similar), it's a nice example of something that's both secure and supports any client without requiring the client to do anything specific to their service. [0] https://www.fastmail.com/help/clients/apppassword.html?u=06984117 https://www.fastmail.com/help/clients/apppassword.html?u=069...
  - cvwright 9y ago
    From the Github issue linked above, apparently Google supports something similar: https://support.google.com/accounts/answer/185833 https://support.google.com/accounts/answer/185833
  - lucideer 9y ago
    Replying to cvwright: That feature is presented by Google as an alternative "for less secure apps". If you're using a client that Google considers to be "less secure", you also have to explicitly enable support for "less secure apps" in settings, in addition to that. This setting may not even be available to you if you're not on @gmail.com and your domain administrator has disabled it (which Google recommends they do).
lucideer 9y ago
> This is a feature, not a bug. Fully agree. My point was that most users will disagree with you and I, or simply not really care to consider our argument. And that informs their choices. Quote from the article: > When I asked what that might look like the answers were uniformly along the lines of: “There is not a really good, open source, Email client on mobile... People encountering issues with proprietary crap like Google's XOAUTH2 implementation could well be contributing to this view.

This is a feature, not a bug. Google comes up with ideas, sure, that doesn't mean all projects have to support it. There is nothing wrong with SSL IMAP auth.

by pmlnr 9y ago

This is a feature, not a bug. Google comes up with ideas, sure, that doesn't mean all projects have to support it. There is nothing wrong with SSL IMAP auth.

Arnt 9y ago

SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead client stores an app-specific password-like string instead, one with limited rights), which is a big improvement IMNSHO.

jimktrains2 9y ago
Which is different from XOAUTH2. The "less secure apps" listed in google still list ones using app-specific passwords.
lucideer 9y ago
If you look at how, e.g. Fastmail solves this[0] (and other services do the same or similar), it's a nice example of something that's both secure and supports any client without requiring the client to do anything specific to their service. [0] https://www.fastmail.com/help/clients/apppassword.html?u=06984117 https://www.fastmail.com/help/clients/apppassword.html?u=069...
- cvwright 9y ago
  From the Github issue linked above, apparently Google supports something similar: https://support.google.com/accounts/answer/185833 https://support.google.com/accounts/answer/185833
- lucideer 9y ago
  Replying to cvwright: That feature is presented by Google as an alternative "for less secure apps". If you're using a client that Google considers to be "less secure", you also have to explicitly enable support for "less secure apps" in settings, in addition to that. This setting may not even be available to you if you're not on @gmail.com and your domain administrator has disabled it (which Google recommends they do).

lucideer 9y ago

> This is a feature, not a bug. Fully agree. My point was that most users will disagree with you and I, or simply not really care to consider our argument. And that informs their choices. Quote from the article: > When I asked what that might look like the answers were uniformly along the lines of: “There is not a really good, open source, Email client on mobile... People encountering issues with proprietary crap like Google's XOAUTH2 implementation could well be contributing to this view.