> just by using a server-side mechanism Google could have promoted since… forever? Google has been pushing 2FA and App Specific Passwords for many many years.

> just by using a server-side mechanism Google could have promoted since… forever? Google has been pushing 2FA and App Specific Passwords for many many years. They’re just now making it mandatory for apps that can’t update to support oauth