6 ms·

It's crazy how mutt still doesn't have native oauth support. I now there's external scripts, but this is a common authentication standard which is being neglect

It's crazy how mutt still doesn't have native oauth support. I now there's external scripts, but this is a common authentication standard which is being neglected by developers. I wonder how many mutt users actually degrade account security to make their clients work without realizing the mistake.

ASalazarMX 4y ago
I feel the same. Supporting several methods of authentication is not selling out to big corporations, is part of being a modern software. Software doesn't need a GUI to be modern.
woodruffw 4y ago
I use an application password with mutt (really neomutt). IMO this is not a significant degradation in my security posture: the application password is scoped, and mutt executes my password manager to retrieve it. Supporting OAuth would be good, but I also understand perfectly why they don’t: it’s not part of the standards. If Google wants universal adoption, they should go through a standards track rather than throwing their weight around. And again, I say that as someone who would gladly use OAuth in mutt.
- 0daystock 4y ago
  How is the application password "scoped"? Can I not retrieve your Drive, Photos and Hangouts content with the same credential you generated for Gmail? Unless you're using OAuth, I believe I most certainly can.
  - woodruffw 4y ago
    Hmm, it looks like I was wrong about that. I remember scoping it, but maybe that was just me naming the password in Google's UI. So yes, it looks like it's roughly equivalent to a normal Google login (but without the 2FA requirements?). That's too bad.
    - 0daystock 4y ago
      It's especially confusing because Google calls them "application-specific" passwords, but they are anything but that!
  - ghostpepper 4y ago
    Fastmail allows scoping. You can allow POP, IMAP, SMTP, CardDAV, WebDAV and CalDAV individually
mikevin 4y ago
You could fix that by contributing since it's open-source and GPL-licenced. https://gitlab.com/muttmua/mutt https://gitlab.com/muttmua/mutt
superkuh 4y ago
Well, oauth support won't help. OAuth2 support is required. And OAuth2 is not so much a standard as a standard to make standards. So supporting OAuth2 for one megacorp does not mean supporting it for another.

ASalazarMX 4y ago

I feel the same. Supporting several methods of authentication is not selling out to big corporations, is part of being a modern software. Software doesn't need a GUI to be modern.

woodruffw 4y ago

I use an application password with mutt (really neomutt). IMO this is not a significant degradation in my security posture: the application password is scoped, and mutt executes my password manager to retrieve it. Supporting OAuth would be good, but I also understand perfectly why they don’t: it’s not part of the standards. If Google wants universal adoption, they should go through a standards track rather than throwing their weight around. And again, I say that as someone who would gladly use OAuth in mutt.

0daystock 4y ago
How is the application password "scoped"? Can I not retrieve your Drive, Photos and Hangouts content with the same credential you generated for Gmail? Unless you're using OAuth, I believe I most certainly can.
- woodruffw 4y ago
  Hmm, it looks like I was wrong about that. I remember scoping it, but maybe that was just me naming the password in Google's UI. So yes, it looks like it's roughly equivalent to a normal Google login (but without the 2FA requirements?). That's too bad.
  - 0daystock 4y ago
    It's especially confusing because Google calls them "application-specific" passwords, but they are anything but that!
- ghostpepper 4y ago
  Fastmail allows scoping. You can allow POP, IMAP, SMTP, CardDAV, WebDAV and CalDAV individually

mikevin 4y ago

You could fix that by contributing since it's open-source and GPL-licenced. https://gitlab.com/muttmua/mutt https://gitlab.com/muttmua/mutt

superkuh 4y ago

Well, oauth support won't help. OAuth2 support is required. And OAuth2 is not so much a standard as a standard to make standards. So supporting OAuth2 for one megacorp does not mean supporting it for another.