Re: [Fetchmail-users] Planned Google authentication changes

[Carlos E. R. <rob...@te...>]

On 2022-03-23 13:04, Matthias Andree wrote:
> Am 23.03.22 um 12:25 schrieb Carlos E. R.:

Oh, sourceforge are using greylisting. 20 minutes! This can push people 
to repeat the posting in despair. Weird setting.

>>
>> Found the reference, a post on usenet (comp.mobile.android) by Frank
>> Slootweg:
>>
>> +++-----------------
>> [...]
>> "It looks like you're using App Passwords to give third-party apps
>>  access to your account, [deleted]. To make your account more secure,
>>  disable App Passwords and use "Sign in with Google" to connect apps to
>>  your Google Account."
>>
>>   They are*really*  trying to get us to use "Sign in with Google",
>> aren't they!?
>> :-(
>> -----------------++-
> 
> 
> Thanks Carlos for both your posts.

Welcome :-)

> 
> That is also my impression that at some point in the future they might
> want to take app passwords away there, too. It's not clear, but I was
> under a similar impression.

I will then have to find another mail provider that is not a pain on the 
ass. Payware but cheap is fine. EU based. I see you mentioned posteo.de 
and mailbox.org. gmx is also a pain in the backside sometimes (the pay 
version is not available in Spain, AFAIK).

I have one gmail account which is not associated with a phone, so 2FA is 
not possible unless those "backup codes" work.

Interestingly, I have two gmail for groups (think @ieee.org) that are 
not mentioning any disabling of normal passwords. The group admin 
decides what security policies to enforce.


> The open issue is how to solve the app registration issue. I explicitly
> do NOT want to register fetchmail with a gazillion of services down the
> road, so does anyone have good references to legal interpretations on
> that matter, or possibly references to regulatory incursions that were
> aimed to avoid such registration obligations in some states? Thanks in
> advance.

I have no idea, sorry. Oauth2 is a pain on the ass, everybody says. 
Check perhaps what Alpine mail client does. I can not explain the 
method, I don't understand it. xoauth, I think. I remember the developer 
commenting on that registration thing /he/ would have to do. I have not 
needed to investigate because I'm using app passwords there. (oauth2 is 
not an option for postfix, so I didn't bother to try oauth2 in alpine).

-- 
Cheers / Saludos,

		Carlos E. R.
		(from 15.3 x86_64 at Telcontar)