OS/2, eCS & ArcaOS - Technical > Mail-News

How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?

<< < (6/6)

Dariusz Piatkowski:
Andi!


--- Quote from: Andi B. on June 18, 2022, 08:55:38 pm ---So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

--- End quote ---

...but that's a massive oversimplification of what's going on: if it wasn't for the shortcomings of our platform you would most likely want a two-factor authentication solution!

Since we are unable to use it, we need the kind of functionality app-passwords provide and so how can you 'blame' Google for the lack of security there? Heck...they are doing us all a huge favour by continuing to accept the existence of this security hole!!!

Dave Yeo:

--- Quote from: Andi B. on June 18, 2022, 08:55:38 pm ---
--- Quote from: mauro on June 18, 2022, 08:36:09 pm ---
--- Quote from: Dave Yeo on June 16, 2022, 04:01:50 pm ---

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.


--- End quote ---

confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

--- End quote ---

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

--- End quote ---

Well, if someone acquires your Google password, they can't download all your mail without your phone number. Not much of an improvement but still an improvement.
Using OAth 2.0 gives about the same level of security. A lot of it seems like security theatre, "hey we're doing something about making things more secure"

Jan-Erik Lärka:
I'm not impressed by the suggestion to add two stage verification.
I log on from different computers and absolutel don't want them to send anything to my phone every time I need to use thier services.
I've now disabled two stage verification and set google to forward my emails.

Dave Yeo:
That's another way to solve the problem. Note that the phone thing only happens when using a new device, so once for each computer to verify it is yours logging in.

Navigation

[0] Message Index

[*] Previous page

Go to full version