How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?

[Alfredo Fernández Díaz]

Hi everyone...

Google sent me this a few weeks ago:
----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----
On May 30th, you may lose access to applications that use a less secure login technology.

To protect your gmail.com account, Google will not allow to use applications or third-party devices that ask you to login to your Google account using only your user name and password. Instead, you will have to login via "Sign in with Google" or other more secure technologies, like OAuth 2.0.

What you have to do:

E-mail software, like Outlook 2016 or previous versions, accesses your Gmail account through less secure means. Switch to Office 365, Outlook 2019 (or a newer version), or another email software in which you can login through "Sign in with Google".
----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----

Somewhere else, I read how to setup gmail accounts to use OAuth 2.0 under Mail Preferences in ThunderBird, and that it just worked, so I forgot about the issue until I actually tried to do the same recently on SeaMonkey on OS/2...

To the best of my knowledge, the latest SeaMonkey we have available (2.42.9esr 20200322125440) does not support OAuth 2.0. (or I can't find it in the menus under email and news preferences), which in turn I take to mean no more GMail from OS/2. I am not big on using GMail so no problem letting it go if necessary, but this is happening at a most inconvenient time for me, and obeying Murphy's Law the 'cutoff' on the 30th will of course happen while I am on the go.

Am I missing something? Is there some way to use OAuth 2.0 to login to gmail accounts from OS/2 SM / TB?

Thank you in advance,

[Dave Yeo]

I use the alternative, https://support.google.com/accounts/answer/185833, a one time app password, with Thunderbird, so should work on SeaMonkey.

[Andy Willis]

I use OAuth with SM (have with Thunderbird in the past but I haven't been able to load my gmail recently for some reason).  I am not able to use Oatuh with yahoo though.

[Dave Yeo]

Trying OAuth 2.0 on SeaMonkey, it seems to work with notifications happening on my phone to allow me to proceed but it seems to be hung on Sending login information...
Have to try restarting SM
Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP

Edit: Restarting didn't help, nor did safe mode. Could be my profile but the error console shows a problem adding the new login and that it was sending an empty password.

[Dariusz Piatkowski]

I use the alternative, https://support.google.com/accounts/answer/185833, a one time app password, with Thunderbird, so should work on SeaMonkey.

When the 2-step authentication came out, I did exactly what Dave provided the link for: application password.

Super easy setup actually, just use that password instead of the regular one you have on you account, as that one of course will require additional setups that aren't available on our release.

For what it's worth, the above comments are applicable to Thunderbird 45.8.0.

If you need any app specific info, just let me know and I'll be happy to share.

[Andy Willis]

Trying OAuth 2.0 on SeaMonkey, it seems to work with notifications happening on my phone to allow me to proceed but it seems to be hung on Sending login information...
Have to try restarting SM
Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP

Edit: Restarting didn't help, nor did safe mode. Could be my profile but the error console shows a problem adding the new login and that it was sending an empty password.

Interestingly, the hang on sending login information is what I now see in Thunderbird... I do not know what changed there, as far as I recall, the last time it worked successfully with Thunderbird was with the version I now have (which is dated the same as the Seamonkey that works -- 08-29-21).

[Dave Yeo]

Well you could double check the prefs,
user_pref("mail.server.server<x>.realuserName", "username@host.tld");
user_pref("mail.server.server<x>.userName", "username");
and make sure they agree though it didn't seem to help here. That's from bug#1518126. Seems that oath2 only really works reliably with TB78+ and now the latest SM.
I'll apply the patch anyways.

Edit: Actually our msgOAth2Module.js is much different then current OAth2Module.js so above probably doesn't apply and the patch doesn't apply at all

[Andy Willis]

Looking again at what occurs, it seems the OAuth login is fine here in Thunderbird, however, then it asks if I want to allow the app and that is where it hangs (wrong password is seen as a wrong password and no request to allow the app is presented).  Seamonkey was long ago allowed here... I may have cleared Thunderbird (either on purpose at some point or by mistake) and now there is a problem at the point where I am trying to allow it.

[Dave Yeo]

I tried a new profile without success. It's likely that things have changed on Gmail's end and adding a new account is no longer allowed due to deficiencies in our OAuth implementation.
If I get ambitious,  I'll try to trace the changes between 45ESR and 52ESR where it uses OAuth2Module.jsm. Unluckily it looks like the whole of mailnews\base\src has changed and probably dom changes as well.

[Alfredo Fernández Díaz]

Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP

OK, that's why I couldn't find the option anywhere -- I had to create a new IMAP mail account under SM for it to be listed.

I'm not big on having my mail permanently stored on Google's servers*, though, so one-time 'application password' it is -- especially seeing that you seem to have trouble with OAuth2 anyway. Of course, they have my phone number now but application password seems to work so I can go missing for 36 hours without losing access to the account at just the right moment.

Great, thank you everyone!

*It is, anyway. I don't have "leave messages on server [...]" checked, which I take it to mean messages are deleted when I fetch them (classic POP style) -- but I can still get them from my phone too afterwards (only until tomorrow?).

[Dariusz Piatkowski]

So here is something else to consider, I do actually have BOTH of these implemented so it may very well be that the combination of the two allow my TB to work quite fine:

1) Application Password
- this is th process Dave highlighted earlier on

2) Secure Application Flag
- in your Google account you have the option to flag a particular app, or create a generic "email app", that basically tells Google "it's OK if this app accesses my data", you can find this under the "Data & privacy => Apps with access to your account" section

Overall I find the Google way of presenting things to be somewhat too-fuzzy, perhaps being an IT person by profession I prefer to see things clearly defined in a config-type setup where various options can be either turned ON or OFF...alas, that's not what the world wants!! lol

Anyways, I thought I'd just toss that out there to paint a fuller picture of what I'm currently using. It's been a while since I implemented that, the only problem I had ran into since was that the Google Contacts TB add-on is marked by Google as a "bad actor" and subsequently I can't get my Contacts list to get updated in TB anylonger.

Even my Google-One subscription was useless, went through multiple agents who all claimed to understand the issue but only continued to "kick the can down the road" to another agent. I gave up after a couple of weeks...

[Dave Yeo]

*It is, anyway. I don't have "leave messages on server [...]" checked, which I take it to mean messages are deleted when I fetch them (classic POP style) -- but I can still get them from my phone too afterwards (only until tomorrow?).

Actually Google generally keeps your messages forever, even when using POP with the setting to don't leave mail on the server. It is just marked read and not as easily visible.
You can test by logging into the web interface of gmail and searching for an old message.
I've been slowly moving to gmx.com, simpler to use as they don't do all the security stuff, hosted in Germany so better privacy laws.

[Remy]

Ising latest Thunderbird build.

Gmail imap only:
- Trying to change from normal password to OAuth under one gmail account, it will not work.
- Trying to add a new gmail account with OAuth, it opens a google logon screen, I could login but then, thunderbird is in a loop
  and it never creates the new gmail account  (it looks like it is hanging due to a gmail account already exist !)
...

? strange...

[Dave Yeo]

Our implementation is old and likely broken compared to what Gmail and others expect. For example, 52ESR has about 4 times the code to handle OAuth 2.0.
I also came across this, https://www.pmail.com/devnews.htm which makes the claim it is simply broken, overly complex and not really documented

[Alfredo Fernández Díaz]

Actually Google generally keeps your messages forever, even when using POP with the setting to don't leave mail on the server. It is just marked read and not as easily visible.
You can test by logging into the web interface of gmail and searching for an old message.

No need to test, I know, that's why I mentioned accessing them from my phone after they were "popped off" from the server -- you wouldn't see them if they had actually been erased.

Speaking of which, I just checked and I lost access from my phone on the 30th because I refuse to use the GMail client or anything but the 'generic' email Android application. I wonder if I will see all previously "deleted" messages when I set up access for it again :DD

I've been slowly moving to gmx.com, simpler to use as they don't do all the security stuff, hosted in Germany so better privacy laws.

Sure, I don't use gmail for anything that I don't assume will be scrutinized and/or leaked eventually, and I only started using it again when yahoo started bouncing messages from ArcaNoae for no reason.

Would be happy to get rid of both, but it's been years now since their constant attempts to drive lesser players off the game succeeded, and keeping my own email server just became too difficult.

Our implementation is old and likely broken [...] also [...] https://www.pmail.com/devnews.htm [...] makes the claim it is simply broken, overly complex and not really documented.

Which I find even likelier, so yet another moving target.

Anyway, thank you for your support, guys!