Is it possible to use mutt and Gmail without enabling lesssecureapps? I know this post deals with some of those issues (gpg keys and whatnot), and Google strongly recommends IMAP/SMTP protocol users switch to OAuth 2.0, etc.
I was honestly surprised to see all this gpg setup, yet no mention of application-specific passwords. I've been using email clients with what google now calls an "App password" for years.
"application-specific passwords" are not actually restricted to a single application. You can restrict the scope (only has access to your emails, for example), but any application could use this password to access your emails.
Sure, but you can revoke them without changing your password or revoking other app passwords, making it much easier to recover if they do leak.
Yes, I do it, but honestly, it is a pain. I didn't look too hard, but at first glance it seems there is no way to get a persistent token to work. Everytime you don't renew your token after 1800 seconds, you have to open the google developer web page and get a new one.