Re: gmail+imap+smtp (oauth2)

[Tim Cross]

Uwe Brauer <oub@mat.ucm.es> writes:

> [[S/MIME Signed Part:Undecided]]
>
>> On 03.05.2022 07:59, Uwe Brauer wrote:
>> My understanding may not be perfect, but having considered a similar
>> conundrum for a work-integration, I landed on the conclusion that SMTP
>> and IMAP should keep working as long as you use app-passwords for
>> logging in to your account. If so, that should probably be adequate
>> for Emacs too.
>
>
> I am not to understand the meaning of  app-passwords.
>

There is nothing too concerning here. An application password is just
another password you can use to authenticate for a specific purpose. You
could in fact have 2 application passwords - 1 for IMAP and 1 for SMTP.
These application passwords are typically much longer than most user
passwords and you don't get to select it - the password is generated for
you. 

Your 'normal' Google password will only work as part of a 2FA
authentication process. You enter your account name (google email
address usually), your password and then a 2nd factor (fingerprint, code
from an authentication app, hardware key etc).  If your IMAP or SMTP/MUA
clients support oauth2, you don't need application passwords, you can
just use your google username/password and 2nd factor. Problem is, many
clients, particularly older ones, don't support oauth2. The situation is
further compounded by the fact that oauth2 implementations vary enough
that it is very difficult to just implement a 'generic' oauth2 solution
in a high level, easy to use manner. For example, it is possible to
configure Emacs' SMTP to use oauth2, but it is clunky, requires a
significant level of udnerstanding of oauth2 and manual steps
(such as getting a token from a web page and putting it into your 
configuration).

> My email account has a password, that is used when connecting via ssl
> or tls. But gmail will need a different protocol in the future, this is
> why I am worried.
>

A 'different protocol' is perhaps over stating it. The SMTP protocol
itself isn't changing, but the authentication mechanism is. At present,
I think we are in a transition stage and like many transitions, things
are a bit rough around the edges. At some point, I suspect Google will
remove application passwords. However, I expect this will only happen
once the alternative authentication mecahnisms have stabilised and
standardised more than they are at present. By that time, I would also
expect many of the clients will support the new authentication
protocols.