6 ms·

Does this mean no more app tokens, e.g. to retrieve IMAP mail?

by eadmund 5y ago

rwmj 5y ago
Thankfully not so far - it says on that page you can still use an App Password.
- eadmund 5y ago
  Ah-ha, thanks. I missed that my first read through. Must need to finish my coffee …
- shawnz 5y ago
  It does mention app passwords on this page, but it's not clear that they are saying app passwords will continue to work after this change.
- Piskvorrr 5y ago
  Those are also on the way out...
  - rwmj 5y ago
    And that'll be the point I stop using gmail, which will probably be a good thing.
    - Piskvorrr 5y ago
      Sure, why not. It's not as if Google has a monopoly on email.
  - jefftk 5y ago
    Why do you say that?
    - Piskvorrr 5y ago
      Ah, sorry: what was phased out was app passwords without two-factor authentication; I thought it applied to all app passwords.
vdfs 5y ago
No, you can still use IMAP with Thunderbird for example but you login to google account and Thunderbird get a token similar to how all OAuth works, what is blocked is using email/passowrd directly with your IMAP client.
- shawnz 5y ago
  What about clients which don't support that, like Google's "send mail as" feature? I suppose that won't be supported anymore?
  - Arkanosis 5y ago
    From the client's point of view, it's like a password. Just not your password. (edit: talking about app passwords, unrelated to oauth or stuff like that)
  - jerryzh 5y ago
    They are exactly what are so-called not safe, take kmail as example
  - Piskvorrr 5y ago
    Indeed: this is a hard compatibility break, without a simple workaround. The thing is, this is nowhere near new: it's been announced years ago, and slowly rolled out since 2019. Actually, IIRC, the rollout has been postponed at least once in 2020, due to covid (in order to not cut people off). I recall implementing Xoauth for IMAP, specifically for this.
    - Fogest 5y ago
      If you have two factor auth on and generate an "app-specific password" doesn't this allow you to do the same thing still? You just use your email and app-specific password to login and it should work still shouldn't it?
      - Piskvorrr 5y ago
asdfasgasdgasdg 5y ago
I do not believe so. Last time this was reported it was about preventing web views from being used to sign in. The idea is to prevent apps from phishing your credentials. Instead, you have to hand off to a secure browser for sign-in. After signed in, the app should be able to do anything it was able to do before.
deleted 5y ago
[deleted]

Does this mean no more app tokens, e.g. to retrieve IMAP mail?

rwmj 5y ago

Thankfully not so far - it says on that page you can still use an App Password.

eadmund 5y ago
Ah-ha, thanks. I missed that my first read through. Must need to finish my coffee …
shawnz 5y ago
It does mention app passwords on this page, but it's not clear that they are saying app passwords will continue to work after this change.
Piskvorrr 5y ago
Those are also on the way out...
- rwmj 5y ago
  And that'll be the point I stop using gmail, which will probably be a good thing.
  - Piskvorrr 5y ago
    Sure, why not. It's not as if Google has a monopoly on email.
- jefftk 5y ago
  Why do you say that?
  - Piskvorrr 5y ago
    Ah, sorry: what was phased out was app passwords without two-factor authentication; I thought it applied to all app passwords.

vdfs 5y ago

No, you can still use IMAP with Thunderbird for example but you login to google account and Thunderbird get a token similar to how all OAuth works, what is blocked is using email/passowrd directly with your IMAP client.

shawnz 5y ago
What about clients which don't support that, like Google's "send mail as" feature? I suppose that won't be supported anymore?
- Arkanosis 5y ago
  From the client's point of view, it's like a password. Just not your password. (edit: talking about app passwords, unrelated to oauth or stuff like that)
- jerryzh 5y ago
  They are exactly what are so-called not safe, take kmail as example
- Piskvorrr 5y ago
  Indeed: this is a hard compatibility break, without a simple workaround. The thing is, this is nowhere near new: it's been announced years ago, and slowly rolled out since 2019. Actually, IIRC, the rollout has been postponed at least once in 2020, due to covid (in order to not cut people off). I recall implementing Xoauth for IMAP, specifically for this.
  - Fogest 5y ago
    If you have two factor auth on and generate an "app-specific password" doesn't this allow you to do the same thing still? You just use your email and app-specific password to login and it should work still shouldn't it?
    - Piskvorrr 5y ago

asdfasgasdgasdg 5y ago

I do not believe so. Last time this was reported it was about preventing web views from being used to sign in. The idea is to prevent apps from phishing your credentials. Instead, you have to hand off to a secure browser for sign-in. After signed in, the app should be able to do anything it was able to do before.

deleted 5y ago

[deleted]