4 ms·

So how will thunderbird (and other software) sign into gmail accounts?

anoncake 6y ago
You are not supposed to use Thunderbird. You are supposed to use the web interface so Google can control your experience and show you ads.
ForHackernews 6y ago
Thunderbird can use "app passwords" and/or oauth2, I believe. It's not trying to maintain a browser session login cookie.
- Macha 6y ago
  So app passwords are something Google are slowly boiling the frog on to get rid of. As of the last year or two, Thunderbird is using OAuth2. _The way it does OAuth_, is by opening a google sign in in an embedded browser, and then catching the API key in the redirect by intercepting the navigation in the embedded browser. It's not a browser session cookie, but it does require the user to log in. To replace this and use the desktop browser, thunderbird would have to spin up a web server, and I'm not sure what restrictions Google have about TLS on redirect targets, which may be problematic to spin up a trusted TLS server on arbitrary end user devices. They could of course set up a centralised service to echo the token back to end users, but this seems likely to be even higher risk of the service stealing your oauth tokens and less trusted by those types of users still using a desktop email client.
  - kuschku 6y ago
    They can just set a thunderbird:// redirect uri and register a custom OS protocol handler
izacus 6y ago
Same way it does right now (and many apps did it for years): it'll open your default browser (Chrome, Firefox, whatever) and wait for it to return the oauth token to it.
- chmod775 6y ago
  It opens a google sign-in window within thunderbird for me. Interesting.
  - izacus 6y ago
    They may going to have to change that to bounce through your default browser.
- FemmeAndroid 6y ago
  How does this work? Like, in practice I understand how you open the default web browser and log in, and get an oauth token. But how does the default browser hand it back to thunderbird or whatever application made the request? Is there a standard way for a browser to return a value to an application that called it?
  - JoshTriplett 6y ago
    This is part of the normal OAuth flow. Normally, there's an API call from the app to the site in addition to the app opening the user's browser.
  - asdfasgasdgasdg 6y ago
    I don't know, but there are lots of apps that do stuff this way. Not to mention every tv app that has you sign in on your desktop. Clearly there are ways.
  - syjer 6y ago
    The trick is setting the right redirect_uri [0]. Generally it's implemented with a custom URI scheme (that the target application is registered for) or a loopback ip address. [0] https://developers.google.com/identity/protocols/oauth2/native-app#sample-authorization-urls https://developers.google.com/identity/protocols/oauth2/nati...
    - magicalhippo 6y ago
yyyk 6y ago
Standard POP3/IMAP logins should still work, I believe?

You are not supposed to use Thunderbird. You are supposed to use the web interface so Google can control your experience and show you ads.

ForHackernews 6y ago

Thunderbird can use "app passwords" and/or oauth2, I believe. It's not trying to maintain a browser session login cookie.

Macha 6y ago
So app passwords are something Google are slowly boiling the frog on to get rid of. As of the last year or two, Thunderbird is using OAuth2. _The way it does OAuth_, is by opening a google sign in in an embedded browser, and then catching the API key in the redirect by intercepting the navigation in the embedded browser. It's not a browser session cookie, but it does require the user to log in. To replace this and use the desktop browser, thunderbird would have to spin up a web server, and I'm not sure what restrictions Google have about TLS on redirect targets, which may be problematic to spin up a trusted TLS server on arbitrary end user devices. They could of course set up a centralised service to echo the token back to end users, but this seems likely to be even higher risk of the service stealing your oauth tokens and less trusted by those types of users still using a desktop email client.
- kuschku 6y ago
  They can just set a thunderbird:// redirect uri and register a custom OS protocol handler

izacus 6y ago

Same way it does right now (and many apps did it for years): it'll open your default browser (Chrome, Firefox, whatever) and wait for it to return the oauth token to it.

chmod775 6y ago
It opens a google sign-in window within thunderbird for me. Interesting.
- izacus 6y ago
  They may going to have to change that to bounce through your default browser.
FemmeAndroid 6y ago
How does this work? Like, in practice I understand how you open the default web browser and log in, and get an oauth token. But how does the default browser hand it back to thunderbird or whatever application made the request? Is there a standard way for a browser to return a value to an application that called it?
- JoshTriplett 6y ago
  This is part of the normal OAuth flow. Normally, there's an API call from the app to the site in addition to the app opening the user's browser.
- asdfasgasdgasdg 6y ago
  I don't know, but there are lots of apps that do stuff this way. Not to mention every tv app that has you sign in on your desktop. Clearly there are ways.
- syjer 6y ago
  The trick is setting the right redirect_uri [0]. Generally it's implemented with a custom URI scheme (that the target application is registered for) or a loopback ip address. [0] https://developers.google.com/identity/protocols/oauth2/native-app#sample-authorization-urls https://developers.google.com/identity/protocols/oauth2/nati...
  - magicalhippo 6y ago

yyyk 6y ago

Standard POP3/IMAP logins should still work, I believe?