3 ms·
SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead cl
by Arnt 9y ago
SSL IMAP auth prevents bystanders from watching the password. Google's auth goes further, the IMAP client doesn't have to store your password at all. Instead client stores an app-specific password-like string instead, one with limited rights), which is a big improvement IMNSHO.
- jimktrains2 9y agoWhich is different from XOAUTH2. The "less secure apps" listed in google still list ones using app-specific passwords.
- lucideer 9y agoIf you look at how, e.g. Fastmail solves this[0] (and other services do the same or similar), it's a nice example of something that's both secure and supports any client without requiring the client to do anything specific to their service. [0] https://www.fastmail.com/help/clients/apppassword.html?u=06984117 https://www.fastmail.com/help/clients/apppassword.html?u=069...
- cvwright 9y agoFrom the Github issue linked above, apparently Google supports something similar: https://support.google.com/accounts/answer/185833 https://support.google.com/accounts/answer/185833
- lucideer 9y agoReplying to cvwright: That feature is presented by Google as an alternative "for less secure apps". If you're using a client that Google considers to be "less secure", you also have to explicitly enable support for "less secure apps" in settings, in addition to that. This setting may not even be available to you if you're not on @gmail.com and your domain administrator has disabled it (which Google recommends they do).