5 ms·

Just so you know, an app password downgrades the security of your 2FA+Password pairing, and I never use app paswords because of that. If it was somehow possible

Just so you know, an app password downgrades the security of your 2FA+Password pairing, and I never use app paswords because of that. If it was somehow possible to intercept the password used in the IMAP handshake, then that means access to your inbox without 2FA. This is why I am a huge fan of web-based clients and not things like Thunderbird.

AdmiralAsshat 8y ago
I could've sworn you had some granular level of control as far as what the apps are allowed to do when they access your Gmail account, e.g. Reading emails only versus read/reply/compose, etc. Maybe I'm thinking of OAuth. For some reason I also thought there was some way of tying the app's identity to the password, such that if an app other than Thunderbird tried to use my Gmail Thunderbird-app password, Gmail would block it. But I'm probably wrong on that point. Would be a great enhancement, if not.
- jcranmer 8y ago
  If you enable IMAP access, the only granularity of control you get is "total access" versus "no access."
CyberShadow 8y ago
> This is why I am a huge fan of web-based clients and not things like Thunderbird. A false dichotomy. 2FA login is achieved through "web login", where an authentication token is obtained by presenting the service's 2FA interface in a web frame or a simple web browser. See e.g. the initial setup flow in Android 4.x - the Google login and password are a regular form, but if 2FA is enabled, you're shown a web browser. Whether clients like Thunderbird implement web login remains a quality of implementation issue...
jcranmer 8y ago
IMAP authentication is done within SSL, so you'd have to start with an SSL MITM to be able to access the password login anyways. If you're scared about people having access to that, there are quite a few password authentication schemes baked into IMAP that don't leak your password over the network (SCRAM-SHA-256, anybody?). That said, all IMAP servers in practice implement only plaintext auth, or maybe NTLM and Kerberos.
- Borealid 8y ago
  Or a brute-force attack guesses your app password. One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way. An app password has no brute-force resistance, so it lowers the security of your otherwise-2FA account overall.
  - deleted 8y ago
    [deleted]
  - CyberShadow 8y ago
    > One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating through all possibilities in order). In fact, you might as well try "000,000" over and over every said 30 seconds, and your guess will eventually be correct after about the above-mentioned 500,000 tries. https://run.dlang.io/is/0A467x https://run.dlang.io/is/0A467x
    - Borealid 8y ago
      I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together. If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.
      - CyberShadow 8y ago
        Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.

AdmiralAsshat 8y ago

I could've sworn you had some granular level of control as far as what the apps are allowed to do when they access your Gmail account, e.g. Reading emails only versus read/reply/compose, etc. Maybe I'm thinking of OAuth. For some reason I also thought there was some way of tying the app's identity to the password, such that if an app other than Thunderbird tried to use my Gmail Thunderbird-app password, Gmail would block it. But I'm probably wrong on that point. Would be a great enhancement, if not.

jcranmer 8y ago
If you enable IMAP access, the only granularity of control you get is "total access" versus "no access."

CyberShadow 8y ago

> This is why I am a huge fan of web-based clients and not things like Thunderbird. A false dichotomy. 2FA login is achieved through "web login", where an authentication token is obtained by presenting the service's 2FA interface in a web frame or a simple web browser. See e.g. the initial setup flow in Android 4.x - the Google login and password are a regular form, but if 2FA is enabled, you're shown a web browser. Whether clients like Thunderbird implement web login remains a quality of implementation issue...

jcranmer 8y ago

IMAP authentication is done within SSL, so you'd have to start with an SSL MITM to be able to access the password login anyways. If you're scared about people having access to that, there are quite a few password authentication schemes baked into IMAP that don't leak your password over the network (SCRAM-SHA-256, anybody?). That said, all IMAP servers in practice implement only plaintext auth, or maybe NTLM and Kerberos.

Borealid 8y ago
Or a brute-force attack guesses your app password. One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way. An app password has no brute-force resistance, so it lowers the security of your otherwise-2FA account overall.
- deleted 8y ago
  [deleted]
- CyberShadow 8y ago
  > One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating through all possibilities in order). In fact, you might as well try "000,000" over and over every said 30 seconds, and your guess will eventually be correct after about the above-mentioned 500,000 tries. https://run.dlang.io/is/0A467x https://run.dlang.io/is/0A467x
  - Borealid 8y ago
    I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together. If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.
    - CyberShadow 8y ago
      Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.