Hacker News Reader

Comment by eadmund | Hacker News Reader

Does this mean no more app tokens, e.g. to retrieve IMAP mail?

No, you can still use IMAP with Thunderbird for example but you login to google account and Thunderbird get a token similar to how all OAuth works, what is blocked is using email/passowrd directly with your IMAP client.

What about clients which don't support that, like Google's "send mail as" feature? I suppose that won't be supported anymore?

Indeed: this is a hard compatibility break, without a simple workaround.

The thing is, this is nowhere near new: it's been announced years ago, and slowly rolled out since 2019. Actually, IIRC, the rollout has been postponed at least once in 2020, due to covid (in order to not cut people off). I recall implementing Xoauth for IMAP, specifically for this.

If you have two factor auth on and generate an "app-specific password" doesn't this allow you to do the same thing still? You just use your email and app-specific password to login and it should work still shouldn't it?

No idea how it works now, tbh - but the problem I was trying to solve, in 2019, was "there isn't always a live human at hand, available to solve two-factor challenges." I distinctly recall that we had to go for xoauth, for lack of other hands-off options.

From the client's point of view, it's like a password. Just not your password. (edit: talking about app passwords, unrelated to oauth or stuff like that)

They are exactly what are so-called not safe, take kmail as example

In other words, Gmail is no longer compliant with Internet email standards like POP3/IMAP.

Actually, IMAP supports various authentication protocols - "plaintext login MUST be supported" was never a part of the spec.

Thankfully not so far - it says on that page you can still use an App Password.

Those are also on the way out...

And that'll be the point I stop using gmail, which will probably be a good thing.

Sure, why not. It's not as if Google has a monopoly on email.

Why do you say that?

Ah, sorry: what was phased out was app passwords without two-factor authentication; I thought it applied to all app passwords.

Ah-ha, thanks. I missed that my first read through. Must need to finish my coffee …

It does mention app passwords on this page, but it's not clear that they are saying app passwords will continue to work after this change.

I do not believe so. Last time this was reported it was about preventing web views from being used to sign in. The idea is to prevent apps from phishing your credentials. Instead, you have to hand off to a secure browser for sign-in. After signed in, the app should be able to do anything it was able to do before.

Reply on news.ycombinator.com