Hacker News Reader

Comment by vdfs | Hacker News Reader

No, you can still use IMAP with Thunderbird for example but you login to google account and Thunderbird get a token similar to how all OAuth works, what is blocked is using email/passowrd directly with your IMAP client.

View on HN

What about clients which don't support that, like Google's "send mail as" feature? I suppose that won't be supported anymore?

From the client's point of view, it's like a password. Just not your password. (edit: talking about app passwords, unrelated to oauth or stuff like that)

They are exactly what are so-called not safe, take kmail as example

Indeed: this is a hard compatibility break, without a simple workaround.

The thing is, this is nowhere near new: it's been announced years ago, and slowly rolled out since 2019. Actually, IIRC, the rollout has been postponed at least once in 2020, due to covid (in order to not cut people off). I recall implementing Xoauth for IMAP, specifically for this.

If you have two factor auth on and generate an "app-specific password" doesn't this allow you to do the same thing still? You just use your email and app-specific password to login and it should work still shouldn't it?

No idea how it works now, tbh - but the problem I was trying to solve, in 2019, was "there isn't always a live human at hand, available to solve two-factor challenges." I distinctly recall that we had to go for xoauth, for lack of other hands-off options.

In other words, Gmail is no longer compliant with Internet email standards like POP3/IMAP.

Actually, IMAP supports various authentication protocols - "plaintext login MUST be supported" was never a part of the spec.

Reply on news.ycombinator.com