Re: gmail+imap+smtp (oauth2)

[Tim Cross]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

>> We know.  They know.  We know they know.  They know we know they know.
>> We've been down this drm-keys-embedded-in-application tango so many
>> times already-
>>
>> Now someone explain to me: why do they nevertheless do it?
>
> Regardless of this "why", I think what it means is that it's perfectly
> OK to use it in Free Software, with the "secret" key in plain sight.
>
> I think from Google's point of view all it means is that we're more
> prone to DoS attacks where someone abuses the "secret" key causing
> Google to revoke the key.  Google won't suffer from it, we will, so they
> don't care.
>

Agree. I also suspect this is the same rationale being used by
Thunderbird and others.