3 ms·

Sounds like oauth, which is an open standard.

• jeroenhd 5y ago
  OAuth is far from standard in email. Google is the only company I know of that uses it for email. Per-application passwords are static passwords you generate for special applications. This way, the standard IMAP/SMTP logins will work, but a leaked password does not expose your entire Google account, only the email part. It also allows revocation of one application without re-entering your password on every device. It works flawlessly for many services, and Google supports/supported it as well. Using it just flags/flagged your account as "insecure" for some reason. Probably because they want you to use their propietary OAuth flow where they have more control over your software.
  • g_p 5y ago
    Microsoft, Yahoo (i.e. OATH) and others also use it, but it has limited adoption beyond the "big giants" of email. https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://docs.microsoft.com/en-us/exchange/client-developer/l... In a way, server providers prefer it as (in theory) users' long term credentials don't end up stored locally in plain text. A revocable per application token is used instead, and they can trace that back to a specific application or developer registration. That it trains users it's ok to enter passwords in bespoke web views using abnormal or no clear URL view is a big issue though in my opinion - I've never liked flows that encourage entering passwords into web browsers you didn't open yourself, let alone ones provided by third party software, which can capture anything happening within the app itself.