By the way, to use IMAP/SMTP you will need to switch "enable unsecure apps" in Google Account preferences. Google considers all auth methods except OAuth2 to be

By the way, to use IMAP/SMTP you will need to switch "enable unsecure apps" in Google Account preferences. Google considers all auth methods except OAuth2 to be insecure (and OAuth2 doesn't work in my slightly outdated version of Thunderbird). But I think the opposite: with OAuth2 the token is stored on your device, with password auth the password is not stored anywhere.