How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?

[Dariusz Piatkowski]

Hi Remy,

Ising latest Thunderbird build.

Gmail imap only:
- Trying to change from normal password to OAuth under one gmail account, it will not work.
- Trying to add a new gmail account with OAuth, it opens a google logon screen, I could login but then, thunderbird is in a loop
  and it never creates the new gmail account  (it looks like it is hanging due to a gmail account already exist !)
...

? strange...

Here is what I did to change the TB password from the previously working OAuth to the 'app-specific' Google password:

1) Get the Google 'app-specifc' password generated (see the previous post re: details), set it aside
2) TB => Tools => Options => Security
3) select 'Passwords' TAB => Saved Passwords

Now you will see all the account credentials you've been using so far.

In the same of Gmail I have the following defined:

1) imap://imap.gmail.com (for incoming)
2) smtp://smtp.gmail.com (for outgoing)

...for both of these (they appear in the same window) go ahead and select the 'Show Password' button.

Now you are ready to change the password from the old OAuth verison to the 'app-specific' one that you previously generated and set aside.

To do this, just double-click on the password you want to change (under the 'Password' column), this will switch that field into an EDIT mode where you can now replace as needed.

In my case I have a couple of accounts setup in TB to use Gmail. One is still using OAuth and the other one is using 'app-specific' password. They both work fine!

[mauro]

from my side I can tell that after having created the app password in Gmail settings, Seamonkey mailer handles Gmail account access by this password (stored in the preferences) with no autentication problems, both receiving/sendings.

[Andreas Schnellbacher]

There's a new news entry from Arca Noae: Resolving issues with GMail and OAuth 2.0 requirements.

[mauro]

from my side I can tell that after having created the app password in Gmail settings, Seamonkey mailer handles Gmail account access by this password (stored in the preferences) with no autentication problems, both receiving/sendings.

better explain: when write "no autentication problems" means that autentication is well working  (while it could also be misunderstood as giving issues of no-autentication)

[Andi B.]

As google now disable comfortable access to there mail and calendar I'm moving completely away from this company. I've used there services only for test purposes so no big problem. Anyway I read Arca Noaes hints about new authentication. But I don't like to activate 2-factor authentication cause this would need one of the following if I understand correctly -

- Android device or other device running a Google program on it (which is not possible on OS/2 nor KaiOS and not desirable anyway)
- a FIDO security key which needs to be bought and needs to generate a key anytime I want to update my calendar (unthinkable uncomfortable)
- SMS or phone call for every calendar/email login (beside overly uncomfortable I don't even think about giving this company my phone number voluntarily)

Seems this all is a new step from Google to force the world to use their software or leave their universe. I choice second.

[Dave Yeo]

- SMS or phone call for every calendar/email login (beside overly uncomfortable I don't even think about giving this company my phone number voluntarily)

Seems this all is a new step from Google to force the world to use their software or leave their universe. I choice second.

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.
OAuth 2.0 also did similar with Google verifying it was me, though I made multiple attempts to set up.

[Andi B.]

Actually, here it is a SMS...

I've read about you can add your devices to 'known secure ones' and then with these devices you wouldn't asked again (= loosing 2 factor authentication and what's the security benefit now?). Moreover this would need to give them one of my mobile numbers. Although SMS should work over conventional telephone network too, I'm pretty sure my provider don't support it.

...I first used the app password...

Don't get me wrong but I think this is one of the problems I wanted to stress - some people (especially web amateurs) think, everyone has to have an Android phone. Often iPhones are tolerated too. Most of the time only the newest generations. But the world is bigger and more diverse than their horizon ;-).

Let me ask different - is there a way to setup SM/TB for google without using a special Android/iOS program AND without giving them a mobile number? As said, it is not so much important for me as gmail censors emails since a long time and so their service is useless for serious email communication anyway. But for the sake of having trash email addresses for potentially insecure web services gmail was good enough.

[Dave Yeo]

Let me ask different - is there a way to setup SM/TB for google without using a special Android/iOS program AND without giving them a mobile number? As said, it is not so much important for me as gmail censors emails since a long time and so their service is useless for serious email communication anyway. But for the sake of having trash email addresses for potentially insecure web services gmail was good enough.

I don't think so as at a minimum, they want to send you a SMS to verify it is you.
Unluckily, it is the way things are going, in the name of security.
The web mail interface does still work here, using the simplified version I believe. Not the best but for occasional use...

[mauro]

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.

confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

[Andi B.]

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.

confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

[Dariusz Piatkowski]

Andi!

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

...but that's a massive oversimplification of what's going on: if it wasn't for the shortcomings of our platform you would most likely want a two-factor authentication solution!

Since we are unable to use it, we need the kind of functionality app-passwords provide and so how can you 'blame' Google for the lack of security there? Heck...they are doing us all a huge favour by continuing to accept the existence of this security hole!!!

[Dave Yeo]

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.

confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

Well, if someone acquires your Google password, they can't download all your mail without your phone number. Not much of an improvement but still an improvement.
Using OAth 2.0 gives about the same level of security. A lot of it seems like security theatre, "hey we're doing something about making things more secure"

[Jan-Erik Lärka]

I'm not impressed by the suggestion to add two stage verification.
I log on from different computers and absolutel don't want them to send anything to my phone every time I need to use thier services.
I've now disabled two stage verification and set google to forward my emails.

[Dave Yeo]

That's another way to solve the problem. Note that the phone thing only happens when using a new device, so once for each computer to verify it is yours logging in.