Hacker News Reader

Comment by 0daystock | Hacker News Reader

It's crazy how mutt still doesn't have native oauth support. I now there's external scripts, but this is a common authentication standard which is being neglected by developers. I wonder how many mutt users actually degrade account security to make their clients work without realizing the mistake.

View on HN

I use an application password with mutt (really neomutt). IMO this is not a significant degradation in my security posture: the application password is scoped, and mutt executes my password manager to retrieve it.

Supporting OAuth would be good, but I also understand perfectly why they don’t: it’s not part of the standards. If Google wants universal adoption, they should go through a standards track rather than throwing their weight around. And again, I say that as someone who would gladly use OAuth in mutt.

How is the application password "scoped"? Can I not retrieve your Drive, Photos and Hangouts content with the same credential you generated for Gmail? Unless you're using OAuth, I believe I most certainly can.

Hmm, it looks like I was wrong about that. I remember scoping it, but maybe that was just me naming the password in Google's UI.

So yes, it looks like it's roughly equivalent to a normal Google login (but without the 2FA requirements?). That's too bad.

It's especially confusing because Google calls them "application-specific" passwords, but they are anything but that!

Fastmail allows scoping. You can allow POP, IMAP, SMTP, CardDAV, WebDAV and CalDAV individually

You could fix that by contributing since it's open-source and GPL-licenced.

https://gitlab.com/muttmua/mutt

I feel the same. Supporting several methods of authentication is not selling out to big corporations, is part of being a modern software. Software doesn't need a GUI to be modern.

Well, oauth support won't help. OAuth2 support is required. And OAuth2 is not so much a standard as a standard to make standards. So supporting OAuth2 for one megacorp does not mean supporting it for another.

Reply on news.ycombinator.com