4 ms·

Can't alternative clients like k9 implement OAuth on their own? I believe I set up Thunderbird on my desktop with OAuth and it works (With office365). Sadly th

Can't alternative clients like k9 implement OAuth on their own? I believe I set up Thunderbird on my desktop with OAuth and it works (With office365). Sadly the number of email clients I would trust is limited, many send off your credentials to some remote server. EDIT: k9 already supports oauth for imap. https://docs.k9mail.app/en/6.400/accounts/incoming_imap/ https://docs.k9mail.app/en/6.400/accounts/incoming_imap/

dmw_ng 3y ago
The trouble with OAuth is to get a production client ID you must pass a third party security audit.. this is in excess of $20k and AIUI must be repeated periodically. Using a developer client ID is already heavily limited, and I have no doubt now that this ladder has been pulled up, developer IDs will see further restrictions in future. IMAP/POP passwords have long defaulted to disabled in Gmail, Gmail survived 20 years without need for these new restrictions, I can't imagine attack techniques have improved and Google's internal technical staff have regressed so substantially that they are now essential. This change seems more motivated by creating frictions for escaping the Google vortex than anything to do with security.
- rrdharan 3y ago
  > I can't imagine attack techniques have improved and Google's internal technical staff have regressed so substantially I can definitely imagine, and I in fact believe, both of those things to be true.
greatgib 3y ago
On a computer your are ok but not on an Android device. To perform the oauth2 login, the app is forced to send the user to a specific Google webpage. There are only 2 ways to do that, load it inside a WebView within the app or send to an external url to be opened by the phone browser. In both cases, Android (/Google) will capture that and use the "add account to Android" provider. Now, let's suppose that you want to use your own custom WebView to avoid that, then the oauth2 page on Google server will perform a check against that and will refuse to load. Officially "for security reason for the user". :-(

dmw_ng 3y ago

The trouble with OAuth is to get a production client ID you must pass a third party security audit.. this is in excess of $20k and AIUI must be repeated periodically. Using a developer client ID is already heavily limited, and I have no doubt now that this ladder has been pulled up, developer IDs will see further restrictions in future. IMAP/POP passwords have long defaulted to disabled in Gmail, Gmail survived 20 years without need for these new restrictions, I can't imagine attack techniques have improved and Google's internal technical staff have regressed so substantially that they are now essential. This change seems more motivated by creating frictions for escaping the Google vortex than anything to do with security.

rrdharan 3y ago
> I can't imagine attack techniques have improved and Google's internal technical staff have regressed so substantially I can definitely imagine, and I in fact believe, both of those things to be true.

greatgib 3y ago

On a computer your are ok but not on an Android device. To perform the oauth2 login, the app is forced to send the user to a specific Google webpage. There are only 2 ways to do that, load it inside a WebView within the app or send to an external url to be opened by the phone browser. In both cases, Android (/Google) will capture that and use the "add account to Android" provider. Now, let's suppose that you want to use your own custom WebView to avoid that, then the oauth2 page on Google server will perform a check against that and will refuse to load. Officially "for security reason for the user". :-(