fetchmail-users — User questions and discussion

Re: [Fetchmail-users] OAUTH2 Dilemma

[ckeader <ck...@di...>]

> You can install the latest OpenSSL 3.0.x to a separate directory,
> WARNING UNTESTED because I do not have CentOS 7,
> but somewhere along the lines of but maybe needs tweaking:
> unpack OpenSSL 3.0.x, then
> ./config --prefix /opt/openssl3 --openssldir=/usr/lib64
> -Wl,-rpath=/opt/openssl3/lib
> -- and then point your fetchmail 7 alpha build there to use it, with
> ./configure --with-ssl=/opt/openssl3
> 
> The additional burden on you will then be to watch future OpenSSL 3.0.x
> releases and upgrade your /opt/openssl3 should security fixes become
> necessary in some future OpenSSL version, so take notes of what worked
> for you if you had to tweak things.

I can improve on that ... does this list server strip attachments?

I've been rolling my own fetchmail 6.4 rpm on CentOS 6, statically compiled against openssl 1.1.1. The method might work on CentOS 7 with fetchmail 7 and openssl 3.0 in a similar way. Obviously, one should update when either fetchmail or openssl release a new version.

Got rid of gmail. Good riddance.

Re: [Fetchmail-users] OAUTH2 Dilemma

[Matthias A. <mat...@gm...>]

Am 27.03.22 um 16:54 schrieb Dennis Putnam:
> On 3/27/2022 7:42 AM, Matthias Andree wrote:
>> Am 26.03.22 um 21:20 schrieb Dennis Putnam:
>>> It appears Fetchmail 7 requires TLS 1.3. I am running CentOS 7 and the
>>> support folks tell me that RedHat does not intend to add TLS 1.3 to
>>> CentOS. I wonder if it will be added to RHEL? Anyway, that means I am
>>> stuck using Fetchmail 6 for the foreseeable future. Before I go to the
>>> trouble, do the OAUTH2 patches for Fetchmail 6 also require TLS 1.3?
>>> TIA.
>>>
>> Dennis,
>>
>> that's a bit of a letdown although I understand that in a stable CentOS
>> 7 series they don't want major changes, and TLS v1.3 in itself is one,
>> so you are stuck between a rock and a hard place... but you can work
>> yourself out of this.
>>
>> You can install the latest OpenSSL 3.0.x to a separate directory,
>> WARNING UNTESTED because I do not have CentOS 7,
>> but somewhere along the lines of but maybe needs tweaking:
>> unpack OpenSSL 3.0.x, then
>> ./config --prefix /opt/openssl3 --openssldir=/usr/lib64
>> -Wl,-rpath=/opt/openssl3/lib
>> -- and then point your fetchmail 7 alpha build there to use it, with
>> ./configure --with-ssl=/opt/openssl3
>>
>> The additional burden on you will then be to watch future OpenSSL 3.0.x
>> releases and upgrade your /opt/openssl3 should security fixes become
>> necessary in some future OpenSSL version, so take notes of what worked
>> for you if you had to tweak things.
>>
>> Hope that helps.
>> Matthias
>>
>
> Hi Matthias,
>
> Thanks for that. So if I understand, it is the need for openssl 3 that
> is the roadblock not the OS itself.

My proposal was to install the latest stable OpenSSL into a separate
place and tell fetchmail where to find it so you do not disturb your
OS's installation in places that other applications would rely on. You
are trying to unite two separate worlds, the minimally-changing
venerable long-term-support CentOS 7 for stability, and on the other
hand you are trying the future still-under-development fetchmail - that
brings the need to update/install requisites.

Answering the earlier question of yours that I missed earlier on: I
don't know what shape the fetchmail 6.x patches are in and I won't care.
OAuth2 is a fetchmail 7 feature. if it will make the release.

Fetchmail 6.4.x is the last minor series to support OpenSSL 1.0.2.
Fetchmail 6.5 will also require TLSv1.3.
It makes no sense for me to let a future fetchmail version carry
compatibility code for working with EOL requisite packages such as
OpenSSL 1.0.2whatever that will never be packaged by any distributor
along with a fetchmail 6.5 or 7.0 version, so I have removed that
OpenSSL 1.0.x stuff, and that is increasingly burdensome to test and
support.

Re: [Fetchmail-users] OAUTH2 Dilemma

[Dennis P. <da...@be...>]

On 3/27/2022 7:42 AM, Matthias Andree wrote:
> Am 26.03.22 um 21:20 schrieb Dennis Putnam:
>> It appears Fetchmail 7 requires TLS 1.3. I am running CentOS 7 and the
>> support folks tell me that RedHat does not intend to add TLS 1.3 to
>> CentOS. I wonder if it will be added to RHEL? Anyway, that means I am
>> stuck using Fetchmail 6 for the foreseeable future. Before I go to the
>> trouble, do the OAUTH2 patches for Fetchmail 6 also require TLS 1.3? 
>> TIA.
>>
> Dennis,
>
> that's a bit of a letdown although I understand that in a stable CentOS
> 7 series they don't want major changes, and TLS v1.3 in itself is one,
> so you are stuck between a rock and a hard place... but you can work
> yourself out of this.
>
> You can install the latest OpenSSL 3.0.x to a separate directory,
> WARNING UNTESTED because I do not have CentOS 7,
> but somewhere along the lines of but maybe needs tweaking:
> unpack OpenSSL 3.0.x, then
> ./config --prefix /opt/openssl3 --openssldir=/usr/lib64
> -Wl,-rpath=/opt/openssl3/lib
> -- and then point your fetchmail 7 alpha build there to use it, with
> ./configure --with-ssl=/opt/openssl3
>
> The additional burden on you will then be to watch future OpenSSL 3.0.x
> releases and upgrade your /opt/openssl3 should security fixes become
> necessary in some future OpenSSL version, so take notes of what worked
> for you if you had to tweak things.
>
> Hope that helps.
> Matthias
>

Hi Matthias,

Thanks for that. So if I understand, it is the need for openssl 3 that 
is the roadblock not the OS itself.

Re: [Fetchmail-users] OAUTH2 Dilemma

[Matthias A. <mat...@gm...>]

Am 26.03.22 um 21:20 schrieb Dennis Putnam:
> It appears Fetchmail 7 requires TLS 1.3. I am running CentOS 7 and the
> support folks tell me that RedHat does not intend to add TLS 1.3 to
> CentOS. I wonder if it will be added to RHEL? Anyway, that means I am
> stuck using Fetchmail 6 for the foreseeable future. Before I go to the
> trouble, do the OAUTH2 patches for Fetchmail 6 also require TLS 1.3? TIA.
>
Dennis,

that's a bit of a letdown although I understand that in a stable CentOS
7 series they don't want major changes, and TLS v1.3 in itself is one,
so you are stuck between a rock and a hard place... but you can work
yourself out of this.

You can install the latest OpenSSL 3.0.x to a separate directory,
WARNING UNTESTED because I do not have CentOS 7,
but somewhere along the lines of but maybe needs tweaking:
unpack OpenSSL 3.0.x, then
./config --prefix /opt/openssl3 --openssldir=/usr/lib64
-Wl,-rpath=/opt/openssl3/lib
-- and then point your fetchmail 7 alpha build there to use it, with
./configure --with-ssl=/opt/openssl3

The additional burden on you will then be to watch future OpenSSL 3.0.x
releases and upgrade your /opt/openssl3 should security fixes become
necessary in some future OpenSSL version, so take notes of what worked
for you if you had to tweak things.

Hope that helps.
Matthias

[Fetchmail-users] OAUTH2 Dilemma

[Dennis P. <da...@be...>]

It appears Fetchmail 7 requires TLS 1.3. I am running CentOS 7 and the 
support folks tell me that RedHat does not intend to add TLS 1.3 to 
CentOS. I wonder if it will be added to RHEL? Anyway, that means I am 
stuck using Fetchmail 6 for the foreseeable future. Before I go to the 
trouble, do the OAUTH2 patches for Fetchmail 6 also require TLS 1.3? TIA.

Re: [Fetchmail-users] OAUTH2 Confusion

[Dennis P. <da...@be...>]

Thanks for the replies and help. Since I have a while to wait so I will 
see if many version 7 will at least be in beta by then.

On 3/24/2022 12:49 PM, Héctor Abreu wrote:
>
>     Unfortunately, that is not an option for me.
>
>
>  I think some users shared in this list that even though fetchmail 7 
> is in alpha, it works with oauth2. Some with more success than others, 
> so maybe it's worth a try for people who really need that feature.
>
> Hector.

Re: [Fetchmail-users] OAUTH2 Confusion

[Héctor A. <hab...@gm...>]

>
> Unfortunately, that is not an option for me.


 I think some users shared in this list that even though fetchmail 7 is in
alpha, it works with oauth2. Some with more success than others, so maybe
it's worth a try for people who really need that feature.

Hector.

Re: [Fetchmail-users] OAUTH2 Confusion

[Dennis P. <da...@be...>]

Unfortunately, that is not an option for me.

On 3/24/2022 12:11 PM, Héctor Abreu wrote:
> I recommend you check the message sent by Matthias Andree to this list 
> on March 4th. It says among other things:
>
> "There is no such thing as a roadmap if you are looking for planned
> release dates.
> This is currently a volunteer spare-time project, not a
> commercially-organized one, and apparently some big tech are trying to
> squeeze out the small ones. More below.
>
> Fetchmail 6.5 should arrive on a scope of months though, albeit without
> OAuth2. It will cut off support for systems not compliant to C99 and/or
> the Single Unix Specification v3.
>
> For fetchmail 7 the release date "depends" on circumstances I have not
> planned yet. After 6.5."
>
> My recommendation based on experience: If you can, keep your GMail 
> address working by forwarding messages, but use any alternative and 
> affordable email service for your GMail address. A service that gives 
> you options rather than forcing you to use oauth2 or telling you that 
> fetchmail will not work after certain date because it's a "less secure 
> app".
>
> Hector.
>
> El jue, 24 mar 2022 a las 11:59, Dennis Putnam (<da...@be...>) 
> escribió:
>
>     Am I correct that fetchmail 7 is only in alpha stage? If so when is a
>     stable release scheduled?
>
>     On 3/24/2022 10:27 AM, Héctor Abreu wrote:
>     > According to what I read in this list, the Fetchmail version that
>     > takes care of oauth2 is version 7. Version 6 can do it with third
>     > party patches.
>     >
>     > I know that every user, circumstances and needs are different,
>     and I
>     > am not familiar with very technical aspects of email services,
>     so in
>     > my particular case this is what I'm doing, just in case it's
>     helpful
>     > to another fetchmail user: Since I only need to keep my GMail
>     address
>     > receiving and sending messages but I don't consider urgent to
>     keep up
>     > with oauth2, I just followed the advise shared in this list about
>     > finding an alternative email service while keeping the GMail
>     address
>     > and not being forced to use oauth2, nor receiving threats from
>     Google
>     > about not allowing "less secure apps" to work (they coined the
>     > expression "less secure"). In this list they mentioned very
>     affordable
>     > services like posteo.de <http://posteo.de> <http://posteo.de>
>     and mailbox.org <http://mailbox.org>
>     > <http://mailbox.org> ; I'm using noip.com <http://noip.com>
>     <http://noip.com> which is
>     > also affordable and it's working for now. I'm only using my GMail
>     > address to appear in the "From: " field and to receive and forward
>     > messages to my new email service (POP3).
>     >
>     > Short story: "Free" email services like GMail or Yahoo are not
>     for me
>     > anymore, I prefer to tell GMail to just forward, I keep using the
>     > GMail address for now and pay a little bit for another email
>     service
>     > that gives me choices instead of forcing me to complicate my
>     life and
>     > waste my time. I will eventually get rid of my GMail address, too.
>     >
>     > Good luck!
>     >
>     > Hector.
>     >
>     > El mié., 23 de marzo de 2022 10:32 a. m., Dennis Putnam
>     > <da...@be...> escribió:
>     >
>     >     I'm a little confused about support for OAUTH2. Is there a
>     version
>     >     that
>     >     does indeed support OAUTH2? I am among those that are stuck
>     using
>     >     gmail
>     >     and we have until May 30, to get this resolved. What is the
>     current
>     >     status? TIA.
>     >     _______________________________________________
>     >     Fetchmail-users mailing list
>     > Fet...@li...
>     > https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>     >
>
>     _______________________________________________
>     Fetchmail-users mailing list
>     Fet...@li...
>     https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>

Re: [Fetchmail-users] OAUTH2 Confusion

[Héctor A. <hab...@gm...>]

I recommend you check the message sent by Matthias Andree to this list on
March 4th. It says among other things:

"There is no such thing as a roadmap if you are looking for planned
release dates.
This is currently a volunteer spare-time project, not a
commercially-organized one, and apparently some big tech are trying to
squeeze out the small ones. More below.

Fetchmail 6.5 should arrive on a scope of months though, albeit without
OAuth2. It will cut off support for systems not compliant to C99 and/or
the Single Unix Specification v3.

For fetchmail 7 the release date "depends" on circumstances I have not
planned yet. After 6.5."

My recommendation based on experience: If you can, keep your GMail address
working by forwarding messages, but use any alternative and affordable
email service for your GMail address. A service that gives you options
rather than forcing you to use oauth2 or telling you that fetchmail will
not work after certain date because it's a "less secure app".

Hector.

El jue, 24 mar 2022 a las 11:59, Dennis Putnam (<da...@be...>)
escribió:

> Am I correct that fetchmail 7 is only in alpha stage? If so when is a
> stable release scheduled?
>
> On 3/24/2022 10:27 AM, Héctor Abreu wrote:
> > According to what I read in this list, the Fetchmail version that
> > takes care of oauth2 is version 7. Version 6 can do it with third
> > party patches.
> >
> > I know that every user, circumstances and needs are different, and I
> > am not familiar with very technical aspects of email services, so in
> > my particular case this is what I'm doing, just in case it's helpful
> > to another fetchmail user: Since I only need to keep my GMail address
> > receiving and sending messages but I don't consider urgent to keep up
> > with oauth2, I just followed the advise shared in this list about
> > finding an alternative email service while keeping the GMail address
> > and not being forced to use oauth2, nor receiving threats from Google
> > about not allowing "less secure apps" to work (they coined the
> > expression "less secure"). In this list they mentioned very affordable
> > services like posteo.de <http://posteo.de> and mailbox.org
> > <http://mailbox.org> ; I'm using noip.com <http://noip.com> which is
> > also affordable and it's working for now. I'm only using my GMail
> > address to appear in the "From: " field and to receive and forward
> > messages to my new email service (POP3).
> >
> > Short story: "Free" email services like GMail or Yahoo are not for me
> > anymore, I prefer to tell GMail to just forward, I keep using the
> > GMail address for now and pay a little bit for another email service
> > that gives me choices instead of forcing me to complicate my life and
> > waste my time. I will eventually get rid of my GMail address, too.
> >
> > Good luck!
> >
> > Hector.
> >
> > El mié., 23 de marzo de 2022 10:32 a. m., Dennis Putnam
> > <da...@be...> escribió:
> >
> >     I'm a little confused about support for OAUTH2. Is there a version
> >     that
> >     does indeed support OAUTH2? I am among those that are stuck using
> >     gmail
> >     and we have until May 30, to get this resolved. What is the current
> >     status? TIA.
> >     _______________________________________________
> >     Fetchmail-users mailing list
> >     Fet...@li...
> >     https://lists.sourceforge.net/lists/listinfo/fetchmail-users
> >
>
> _______________________________________________
> Fetchmail-users mailing list
> Fet...@li...
> https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>

Re: [Fetchmail-users] OAUTH2 Confusion

[Dennis P. <da...@be...>]

Am I correct that fetchmail 7 is only in alpha stage? If so when is a 
stable release scheduled?

On 3/24/2022 10:27 AM, Héctor Abreu wrote:
> According to what I read in this list, the Fetchmail version that 
> takes care of oauth2 is version 7. Version 6 can do it with third 
> party patches.
>
> I know that every user, circumstances and needs are different, and I 
> am not familiar with very technical aspects of email services, so in 
> my particular case this is what I'm doing, just in case it's helpful 
> to another fetchmail user: Since I only need to keep my GMail address 
> receiving and sending messages but I don't consider urgent to keep up 
> with oauth2, I just followed the advise shared in this list about 
> finding an alternative email service while keeping the GMail address 
> and not being forced to use oauth2, nor receiving threats from Google 
> about not allowing "less secure apps" to work (they coined the 
> expression "less secure"). In this list they mentioned very affordable 
> services like posteo.de <http://posteo.de> and mailbox.org 
> <http://mailbox.org> ; I'm using noip.com <http://noip.com> which is 
> also affordable and it's working for now. I'm only using my GMail 
> address to appear in the "From: " field and to receive and forward 
> messages to my new email service (POP3).
>
> Short story: "Free" email services like GMail or Yahoo are not for me 
> anymore, I prefer to tell GMail to just forward, I keep using the 
> GMail address for now and pay a little bit for another email service 
> that gives me choices instead of forcing me to complicate my life and 
> waste my time. I will eventually get rid of my GMail address, too.
>
> Good luck!
>
> Hector.
>
> El mié., 23 de marzo de 2022 10:32 a. m., Dennis Putnam 
> <da...@be...> escribió:
>
>     I'm a little confused about support for OAUTH2. Is there a version
>     that
>     does indeed support OAUTH2? I am among those that are stuck using
>     gmail
>     and we have until May 30, to get this resolved. What is the current
>     status? TIA.
>     _______________________________________________
>     Fetchmail-users mailing list
>     Fet...@li...
>     https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>

Re: [Fetchmail-users] OAUTH2 Confusion

[Dennis P. <da...@be...>]

On 3/24/2022 10:27 AM, Héctor Abreu wrote:
> According to what I read in this list, the Fetchmail version that 
> takes care of oauth2 is version 7. Version 6 can do it with third 
> party patches.
>
> I know that every user, circumstances and needs are different, and I 
> am not familiar with very technical aspects of email services, so in 
> my particular case this is what I'm doing, just in case it's helpful 
> to another fetchmail user: Since I only need to keep my GMail address 
> receiving and sending messages but I don't consider urgent to keep up 
> with oauth2, I just followed the advise shared in this list about 
> finding an alternative email service while keeping the GMail address 
> and not being forced to use oauth2, nor receiving threats from Google 
> about not allowing "less secure apps" to work (they coined the 
> expression "less secure"). In this list they mentioned very affordable 
> services like posteo.de <http://posteo.de> and mailbox.org 
> <http://mailbox.org> ; I'm using noip.com <http://noip.com> which is 
> also affordable and it's working for now. I'm only using my GMail 
> address to appear in the "From: " field and to receive and forward 
> messages to my new email service (POP3).
>
> Short story: "Free" email services like GMail or Yahoo are not for me 
> anymore, I prefer to tell GMail to just forward, I keep using the 
> GMail address for now and pay a little bit for another email service 
> that gives me choices instead of forcing me to complicate my life and 
> waste my time. I will eventually get rid of my GMail address, too.
>
> Good luck!
>
> Hector.
>
> El mié., 23 de marzo de 2022 10:32 a. m., Dennis Putnam 
> <da...@be...> escribió:
>
>     I'm a little confused about support for OAUTH2. Is there a version
>     that
>     does indeed support OAUTH2? I am among those that are stuck using
>     gmail
>     and we have until May 30, to get this resolved. What is the current
>     status? TIA.
>     _______________________________________________
>     Fetchmail-users mailing list
>     Fet...@li...
>     https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>

Thanks for the reply. I will try to get fetchmail 7.

Re: [Fetchmail-users] OAUTH2 Confusion

[Héctor A. <hab...@gm...>]

According to what I read in this list, the Fetchmail version that takes
care of oauth2 is version 7. Version 6 can do it with third party patches.

I know that every user, circumstances and needs are different, and I am not
familiar with very technical aspects of email services, so in my particular
case this is what I'm doing, just in case it's helpful to another fetchmail
user: Since I only need to keep my GMail address receiving and sending
messages but I don't consider urgent to keep up with oauth2, I just
followed the advise shared in this list about finding an alternative email
service while keeping the GMail address and not being forced to use oauth2,
nor receiving threats from Google about not allowing "less secure apps" to
work (they coined the expression "less secure"). In this list they
mentioned very affordable services like posteo.de and mailbox.org ; I'm
using noip.com which is also affordable and it's working for now. I'm only
using my GMail address to appear in the "From: " field and to receive and
forward messages to my new email service (POP3).

Short story: "Free" email services like GMail or Yahoo are not for me
anymore, I prefer to tell GMail to just forward, I keep using the GMail
address for now and pay a little bit for another email service that gives
me choices instead of forcing me to complicate my life and waste my time. I
will eventually get rid of my GMail address, too.

Good luck!

Hector.

El mié., 23 de marzo de 2022 10:32 a. m., Dennis Putnam <da...@be...>
escribió:

> I'm a little confused about support for OAUTH2. Is there a version that
> does indeed support OAUTH2? I am among those that are stuck using gmail
> and we have until May 30, to get this resolved. What is the current
> status? TIA.
> _______________________________________________
> Fetchmail-users mailing list
> Fet...@li...
> https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>

[Fetchmail-users] OAUTH2 Confusion

[Dennis P. <da...@be...>]

I'm a little confused about support for OAUTH2. Is there a version that 
does indeed support OAUTH2? I am among those that are stuck using gmail 
and we have until May 30, to get this resolved. What is the current 
status? TIA.

Re: [Fetchmail-users] OAuth2 authenticator problem

[Robin A. <ro...@bi...>]

On Tue, 22 Mar 2022 09:11:34 +0100
Matthias Andree <mat...@gm...> wrote:
> > Mar 20 22:19:36 localhost fetchmail[29377] We've run out of allowed
> > authenticators and cannot co ntinue.
> > Mar 20 22:19:36 localhost fetchmail[29377] Authorisation failure on
> > xx...@gm...@pop.gmail.com (previously authorised)
> >  
> That's a sign that you had left authentication set to automatic and
> the XOAUTH2 or OAUTHBEARER authentication method started failing with
> your server at some point. Re-obtaining a new token with the script
> may fix it, else running fetchmail in verbose mode (-v or -v -v) may
> give you sufficient information to pinpoint the failure.

I ran 
oauth2 -c /path/to/oauth2Config.properties --obtain_refresh_token_file
again and now the logon proceeds. I will see how long it works, one week
seems to be the limit. If it happens again I will try publishing my app
to see if that helps.

Robin
-- 
----------------------------------------------------------------------
Robin Atwood.

"Ship me somewheres east of Suez, where the best is like the worst,
 Where there ain't no Ten Commandments an' a man can raise a thirst"
         from "Mandalay" by Rudyard Kipling
----------------------------------------------------------------------

Re: [Fetchmail-users] Planned Google authentication changes

[Carlos E. R. <rob...@te...>]

On 2022-03-23 13:04, Matthias Andree wrote:
> Am 23.03.22 um 12:25 schrieb Carlos E. R.:

Oh, sourceforge are using greylisting. 20 minutes! This can push people 
to repeat the posting in despair. Weird setting.

>>
>> Found the reference, a post on usenet (comp.mobile.android) by Frank
>> Slootweg:
>>
>> +++-----------------
>> [...]
>> "It looks like you're using App Passwords to give third-party apps
>>  access to your account, [deleted]. To make your account more secure,
>>  disable App Passwords and use "Sign in with Google" to connect apps to
>>  your Google Account."
>>
>>   They are*really*  trying to get us to use "Sign in with Google",
>> aren't they!?
>> :-(
>> -----------------++-
> 
> 
> Thanks Carlos for both your posts.

Welcome :-)

> 
> That is also my impression that at some point in the future they might
> want to take app passwords away there, too. It's not clear, but I was
> under a similar impression.

I will then have to find another mail provider that is not a pain on the 
ass. Payware but cheap is fine. EU based. I see you mentioned posteo.de 
and mailbox.org. gmx is also a pain in the backside sometimes (the pay 
version is not available in Spain, AFAIK).

I have one gmail account which is not associated with a phone, so 2FA is 
not possible unless those "backup codes" work.

Interestingly, I have two gmail for groups (think @ieee.org) that are 
not mentioning any disabling of normal passwords. The group admin 
decides what security policies to enforce.


> The open issue is how to solve the app registration issue. I explicitly
> do NOT want to register fetchmail with a gazillion of services down the
> road, so does anyone have good references to legal interpretations on
> that matter, or possibly references to regulatory incursions that were
> aimed to avoid such registration obligations in some states? Thanks in
> advance.

I have no idea, sorry. Oauth2 is a pain on the ass, everybody says. 
Check perhaps what Alpine mail client does. I can not explain the 
method, I don't understand it. xoauth, I think. I remember the developer 
commenting on that registration thing /he/ would have to do. I have not 
needed to investigate because I'm using app passwords there. (oauth2 is 
not an option for postfix, so I didn't bother to try oauth2 in alpine).

-- 
Cheers / Saludos,

		Carlos E. R.
		(from 15.3 x86_64 at Telcontar)

Re: [Fetchmail-users] Planned Google authentication changes

[Matthias A. <mat...@gm...>]

Am 23.03.22 um 12:25 schrieb Carlos E. R.:
>
> Found the reference, a post on usenet (comp.mobile.android) by Frank
> Slootweg:
>
> +++-----------------
> [...]
> "It looks like you're using App Passwords to give third-party apps
>  access to your account, [deleted]. To make your account more secure,
>  disable App Passwords and use "Sign in with Google" to connect apps to
>  your Google Account."
>
>   They are*really*  trying to get us to use "Sign in with Google",
> aren't they!?
> :-(
> -----------------++-


Thanks Carlos for both your posts.

That is also my impression that at some point in the future they might
want to take app passwords away there, too. It's not clear, but I was
under a similar impression.

The open issue is how to solve the app registration issue. I explicitly
do NOT want to register fetchmail with a gazillion of services down the
road, so does anyone have good references to legal interpretations on
that matter, or possibly references to regulatory incursions that were
aimed to avoid such registration obligations in some states? Thanks in
advance.

Re: [Fetchmail-users] Planned Google authentication changes

[Carlos E. R. <rob...@te...>]

On 2022-03-23 12:06, Carlos E. R. wrote:
> On 2022-03-22 09:22, Matthias Andree wrote:
>> One more thing on Google specifically,
>>
>> Apparently Google still offer App-specific passwords if users are ready
>> to upgrade their account to 2FA (2-factor authentication).
>>
>> https://support.google.com/accounts/answer/185833
>>
>> Does anyone using Google and have 2-factor authentication enabled for
>> their account
>> have experience with setting that up for fetchmail and can report here?
>
> Not with fetchmail, but I use them with postfix and alpine, so 
> fetchmail should be the same. Just be careful to create one such 
> password for eeach application and machine, don't reuse them.
>
> Someone mentioned he saw a message from Google telling him that he 
> seemed to be attempting to use "less secure applications" without 
> using oauth2, but as long as they don't close the road, that's fine.

Found the reference, a post on usenet (comp.mobile.android) by Frank 
Slootweg:

+++-----------------
   Anyway, I just searched the 'Google Account Help' and found this page
which explains things:

'Sign in with backup codes'
<https://support.google.com/accounts/answer/1187538?hl=en>

   FWIW, I indeed use it as my*backup*  method, in case the normal method
fails for some reason.
   BTW, on the issue of App Passwords, adding insult to injury, when I
got to the 'Sign in with backup codes' page, it showed a header saying:

"It looks like you're using App Passwords to give third-party apps
  access to your account, [deleted]. To make your account more secure,
  disable App Passwords and use "Sign in with Google" to connect apps to
  your Google Account."

   They are*really*  trying to get us to use "Sign in with Google",
aren't they!?
:-(
-----------------++-


Another poster (Arlen) said:


+++-----------------
<https://support.google.com/accounts/answer/1187538>

Sign in with backup codes
If you lose your phone or otherwise can't get codes by text, call, or Google
Authenticator, you can use backup codes to sign in to your Google Account.

Important:

Once you use a backup code to sign in, that code becomes inactive.
You can get a new set of 10 backup codes whenever you want. When you create
a new set of codes, the old set automatically becomes inactive.
To use backup codes, 2-Step Verification must be on.

Create & find a set of backup codes
To store your backup codes somewhere safe, you can print a copy of your
backup codes.

... ((skipping phone instructions)

*On your Computer*
Go to your Google Account.
On the left, click Security.
Under "Signing in to Google," click 2-Step Verification. You may need to sign in.
Under "Backup codes," click Continue .
 From here you can:
Get backup codes: To add backup codes, click Get backup codes.
Create a new set of backup codes and inactivate old ones: To create new codes, click Refresh  .
Delete your backup codes: To delete and automatically inactivate your backup codes, click Delete Delete .
Download your backup codes: Click Download Codes  .
Print your backup codes: Click Print
-----------------++-

Side note: posts to this list take 20 minutes to appear.

-- 
Cheers / Saludos,

		Carlos E. R.
		(from 15.3 x86_64 at Telcontar)

Re: [Fetchmail-users] Planned Google authentication changes

[Carlos E. R. <rob...@te...>]

On 2022-03-22 09:22, Matthias Andree wrote:
> One more thing on Google specifically,
> 
> Apparently Google still offer App-specific passwords if users are ready
> to upgrade their account to 2FA (2-factor authentication).
> 
> https://support.google.com/accounts/answer/185833
> 
> Does anyone using Google and have 2-factor authentication enabled for
> their account
> have experience with setting that up for fetchmail and can report here?

Not with fetchmail, but I use them with postfix and alpine, so fetchmail 
should be the same. Just be careful to create one such password for 
eeach application and machine, don't reuse them.

Someone mentioned he saw a message from Google telling him that he 
seemed to be attempting to use "less secure applications" without using 
oauth2, but as long as they don't close the road, that's fine.

Mind, you need to activate 2FA and keep it active, or they disable these 
passwords. This apparently means having this account on an android phone 
or tablet, which sometimes doesn't happen. But I have been told:

'Sign in with backup codes'
<https://support.google.com/accounts/answer/1187538?hl=en>

   Or use an (TOTP) authenticator app.


I haven't tried either yet.


-- 
Cheers / Saludos,

		Carlos E. R.
		(from 15.3 x86_64 at Telcontar)

Re: [Fetchmail-users] Planned Google authentication changes

[Robin A. <ro...@bi...>]

On Tue, 22 Mar 2022 09:46:42 +0100
Kamil Jońca <kj...@o2...> wrote:
> I also tried oauth2, but it seem that authorization token is valid for
> only a week :(

That was my experience (see "OAuth2 authenticator problem"). In fact, I
set up my Google API account one weekend and didn't finish the
fetchmail updates until the next weekend. Fetchmail ran for a day and
now I get "We've run out of allowed authenticators...". I will try to
refresh my account.

Robin
-- 
----------------------------------------------------------------------
Robin Atwood.

"Ship me somewheres east of Suez, where the best is like the worst,
 Where there ain't no Ten Commandments an' a man can raise a thirst"
         from "Mandalay" by Rudyard Kipling
----------------------------------------------------------------------

Re: [Fetchmail-users] Planned Google authentication changes

[Kamil J. <kj...@o2...>]

Matthias Andree <mat...@gm...> writes:

> One more thing on Google specifically,
>
> Apparently Google still offer App-specific passwords if users are ready
> to upgrade their account to 2FA (2-factor authentication).
>
> https://support.google.com/accounts/answer/185833
>
> Does anyone using Google and have 2-factor authentication enabled for
> their account
> have experience with setting that up for fetchmail and can report here?



I have such config. No problems.


I also tried oauth2, but it seem that authorization token is valid for
only a week :(
So I try to keep app-passwords as long as it can be possible.


-- 
http://wolnelektury.pl/wesprzyj/teraz/

Re: [Fetchmail-users] Planned Google authentication changes

[Christian E. <bc...@ph...>]

* Matthias Andree on Tuesday, March 22, 2022 at 09:22:29 +0100:
> One more thing on Google specifically,
> 
> Apparently Google still offer App-specific passwords if users are ready
> to upgrade their account to 2FA (2-factor authentication).
> 
> https://support.google.com/accounts/answer/185833
> 
> Does anyone using Google and have 2-factor authentication enabled for
> their account

Yes.

> have experience with setting that up for fetchmail and can report here?

I am using the App-specific (rather misleading attribute, it's 
just a password) password with fetchmail and it works (so far?). 
I haven't heard from Google directly about any deadlines, so I'm 
not sure whether the discussion here applies to this case.

FWIW, similar scenario for postfix.

-- 
LAST SHIP HOME
Winner of the German Ocean Film Award 2019
           --->> https://lastshiphome.de/en

Re: [Fetchmail-users] Planned Google authentication changes

[Matthias A. <mat...@gm...>]

One more thing on Google specifically,

Apparently Google still offer App-specific passwords if users are ready
to upgrade their account to 2FA (2-factor authentication).

https://support.google.com/accounts/answer/185833

Does anyone using Google and have 2-factor authentication enabled for
their account
have experience with setting that up for fetchmail and can report here?

Thanks in advance.

Re: [Fetchmail-users] OAuth2 authenticator problem

[Matthias A. <mat...@gm...>]

Am 21.03.22 um 14:56 schrieb Robin Atwood:
> I saw the message from Gmail saying that using apps like fetchmail
> would stop working on 30/05/2022. Searching showed that OAuth2
> support was included in fetchmail-7.0.0-alpha so I installed it. Setting
> up the oauth2 script was straightforward enough but I had a bit of a
> tussle getting registered with Google! Eventually I could kick off
> fetchmail and receive my mail. Thank you Matthew Ogilvie!
>
> But (you knew this was coming :)) after about a day I started getting
> fetchmail messages:
>
> Mar 20 22:19:36 localhost fetchmail[29377] We've run out of allowed authenticators and cannot co
> ntinue.
> Mar 20 22:19:36 localhost fetchmail[29377] Authorisation failure on
> xx...@gm...@pop.gmail.com (previously authorised)
>
That's a sign that you had left authentication set to automatic and the
XOAUTH2 or OAUTHBEARER authentication method started failing with your
server at some point. Re-obtaining a new token with the script may fix
it, else running fetchmail in verbose mode (-v or -v -v) may give you
sufficient information to pinpoint the failure.

Re: [Fetchmail-users] Planned Google authentication changes

[Matthias A. <mat...@gm...>]

Am 21.03.22 um 16:24 schrieb Héctor Abreu:
>>> IIRC I had to enable "use less secure" in gmail for it to work with
>>> fetchmail.  Perhaps  I was just in a hurry then and lazy now?
>>>
>> Yes, that switch used to be there. Not sure how long it will last.
>
>   I just read in my Google Settings (Security section) that the "Less secure
> app access" will no longer be available starting on May 30th, 2022. Does
> this mean that my only option to continue using Fetchmail to read emails
> sent to my GMail Inbox is to forward them to another email service?
>
>> Or just go find a service that does not scan all your email and forces YOU to change.
> Is there any Fetchmail friendly email service that you or anyone in this
> list can recommend? I think I'm having 2 different problems now: One is
> Oath2 (which to me it looks like an inconvenient trend, but I read it can
> be fixed through patches) and the other problem is that soon no "Less
> secure app access" will be allowed in Google anymore.

Whatever that means. Any service that provides free password-based
TLS-encrypted access through IMAP or POP3 will work.

Fetchmail is NOT a "less secure app", that's just fear, uncertainty,
doubt, spread by some of these service providers such as Google or
whoever else has adopted such libel, who want to extend their control
over the Internet. I say that because usually for OAuth2 support, some
form of registering applications is part of the provider's approach, and
that is just not something what we made IETF standards such as IMAP for.

Now OAuth2 may also be specified, but it a holey standard, with lots of
options on the provider's end, which somewhat reminds me of
https://xkcd.com/927/

So vote with your feet and stop using such services such as gmail.

Some services may offer app-specific passwords that users can generate
for a certain part of such a provider's service.

I have heard people speak good things of posteo.de and mailbox.org, both
expect 1 EUR per month payments and have security and privacy in their
mission statement.

[Fetchmail-users] OAuth2 authenticator problem

[Robin A. <ro...@bi...>]

I saw the message from Gmail saying that using apps like fetchmail
would stop working on 30/05/2022. Searching showed that OAuth2
support was included in fetchmail-7.0.0-alpha so I installed it. Setting
up the oauth2 script was straightforward enough but I had a bit of a
tussle getting registered with Google! Eventually I could kick off
fetchmail and receive my mail. Thank you Matthew Ogilvie!

But (you knew this was coming :)) after about a day I started getting
fetchmail messages:

Mar 20 22:19:36 localhost fetchmail[29377] We've run out of allowed authenticators and cannot co
ntinue.
Mar 20 22:19:36 localhost fetchmail[29377] Authorisation failure on
xx...@gm...@pop.gmail.com (previously authorised)

I searched on this but couldn't find anything; I guess not a lot of
people are doing this. Have I left out some admin step? I have the
usual 10000 tokens per day available. I have a cron job refreshing my
access token.

Thanks
Robin
-- 
----------------------------------------------------------------------
Robin Atwood.

"Ship me somewheres east of Suez, where the best is like the worst,
 Where there ain't no Ten Commandments an' a man can raise a thirst"
         from "Mandalay" by Rudyard Kipling
----------------------------------------------------------------------