3 ms·
I like his comments on http://www.pmail.com/devnews.htm http://www.pmail.com/devnews.htm: "I'll resist the urge to let loose, though, and simply say that (1) "
by porker 7y ago
I like his comments on http://www.pmail.com/devnews.htm http://www.pmail.com/devnews.htm:
"I'll resist the urge to let loose, though, and simply say that (1) "Less-secure applications" is crude scare-mongering by Google that means little and is mainly intended to serve their political agenda, and that (2) OAUTH2 is among the most poorly-standardized and ill-considered hacks I've ever encountered in thirty years of serving the Internet."
I would like to read his full rant about OAUTH2 for email authentication!
- gingerlime 7y agoWish I could upvote this more. I think the main part of the post is short enough to post here in full? It's spot-on! > Now, this is a "hot button" issue for me - it will get me started, and if I'm not forcibly held down, it can be very hard to stop me from ranting almost indefinitely. I'll resist the urge to let loose, though, and simply say that (1) "Less-secure applications" is crude scare-mongering by Google that means little and is mainly intended to serve their political agenda, and that (2) OAUTH2 is among the most poorly-standardized and ill-considered hacks I've ever encountered in thirty years of serving the Internet. > That said, GMail's size makes it an effective bully, and regardless of what I might think about OAUTH2, as they say in Star Trek, "resistance is futile". Accordingly, we have been working on implementing support for OAUTH2 in Pegasus Mail, and already have a basic working proof-of-concept on which we can build going forward. We expect to have working OAUTH2 support for GMail (and at this stage, only GMail) well before it will be necessary for continued use of the service. One of the main flaws of OAUTH2 is that it has to be implemented on a service-by-service basis, and at this time we do not have plans to support services other than GMail, although we will review this position over time as required.
- brazzledazzle 7y agoIt looks like their OAuth2 is compliant with OIDC which is way easier to deal with than vanilla Oauth2. OIDC makes things consistent and clear. In practice OAuth2 without the OpenID bits is loosely glued together vendor specific bits.
- porker 7y agoThat is really good to hear. I hate working with OAuth2 (though working with SAML at present, I'm beginning to wish for OAuth2...)
- brazzledazzle 7y agoOIDC is so much easier to deal with than SAML in almost every way. There’s certain scenarios where I like SAML better but they’re really rare.