OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Mail-News => Topic started by: Alfredo Fernández Díaz on May 26, 2022, 12:12:11 pm

Title: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Alfredo Fernández Díaz on May 26, 2022, 12:12:11 pm
Hi everyone...

Google sent me this a few weeks ago:
----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----
On May 30th, you may lose access to applications that use a less secure login technology.

To protect your gmail.com account, Google will not allow to use applications or third-party devices that ask you to login to your Google account using only your user name and password. Instead, you will have to login via "Sign in with Google" or other more secure technologies, like OAuth 2.0.

What you have to do:

E-mail software, like Outlook 2016 or previous versions, accesses your Gmail account through less secure means. Switch to Office 365, Outlook 2019 (or a newer version), or another email software in which you can login through "Sign in with Google".
----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----

Somewhere else, I read how to setup gmail accounts to use OAuth 2.0 under Mail Preferences in ThunderBird, and that it just worked, so I forgot about the issue until I actually tried to do the same recently on SeaMonkey on OS/2...

To the best of my knowledge, the latest SeaMonkey we have available (2.42.9esr 20200322125440) does not support OAuth 2.0. (or I can't find it in the menus under email and news preferences), which in turn I take to mean no more GMail from OS/2. I am not big on using GMail so no problem letting it go if necessary, but this is happening at a most inconvenient time for me, and obeying Murphy's Law the 'cutoff' on the 30th will of course happen while I am on the go.

Am I missing something? Is there some way to use OAuth 2.0 to login to gmail accounts from OS/2 SM / TB?

Thank you in advance,
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 26, 2022, 04:18:32 pm
I use the alternative, https://support.google.com/accounts/answer/185833 (https://support.google.com/accounts/answer/185833), a one time app password, with Thunderbird, so should work on SeaMonkey.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andy Willis on May 27, 2022, 04:20:47 am
I use OAuth with SM (have with Thunderbird in the past but I haven't been able to load my gmail recently for some reason).  I am not able to use Oatuh with yahoo though.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 27, 2022, 05:10:19 am
Trying OAuth 2.0 on SeaMonkey, it seems to work with notifications happening on my phone to allow me to proceed but it seems to be hung on Sending login information...
Have to try restarting SM
Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP

Edit: Restarting didn't help, nor did safe mode. Could be my profile but the error console shows a problem adding the new login and that it was sending an empty password.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dariusz Piatkowski on May 27, 2022, 04:51:00 pm
I use the alternative, https://support.google.com/accounts/answer/185833 (https://support.google.com/accounts/answer/185833), a one time app password, with Thunderbird, so should work on SeaMonkey.

When the 2-step authentication came out, I did exactly what Dave provided the link for: application password.

Super easy setup actually, just use that password instead of the regular one you have on you account, as that one of course will require additional setups that aren't available on our release.

For what it's worth, the above comments are applicable to Thunderbird 45.8.0.

If you need any app specific info, just let me know and I'll be happy to share.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andy Willis on May 28, 2022, 10:52:19 pm
Trying OAuth 2.0 on SeaMonkey, it seems to work with notifications happening on my phone to allow me to proceed but it seems to be hung on Sending login information...
Have to try restarting SM
Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP

Edit: Restarting didn't help, nor did safe mode. Could be my profile but the error console shows a problem adding the new login and that it was sending an empty password.

Interestingly, the hang on sending login information is what I now see in Thunderbird... I do not know what changed there, as far as I recall, the last time it worked successfully with Thunderbird was with the version I now have (which is dated the same as the Seamonkey that works -- 08-29-21).
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 29, 2022, 05:53:27 am
Well you could double check the prefs,
user_pref("mail.server.server<x>.realuserName", "username@host.tld");
user_pref("mail.server.server<x>.userName", "username");
and make sure they agree though it didn't seem to help here. That's from bug#1518126. Seems that oath2 only really works reliably with TB78+ and now the latest SM.
I'll apply the patch anyways.

Edit: Actually our msgOAth2Module.js is much different then current OAth2Module.js so above probably doesn't apply and the patch doesn't apply at all
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andy Willis on May 29, 2022, 06:54:28 am
Looking again at what occurs, it seems the OAuth login is fine here in Thunderbird, however, then it asks if I want to allow the app and that is where it hangs (wrong password is seen as a wrong password and no request to allow the app is presented).  Seamonkey was long ago allowed here... I may have cleared Thunderbird (either on purpose at some point or by mistake) and now there is a problem at the point where I am trying to allow it.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 29, 2022, 07:28:10 am
I tried a new profile without success. It's likely that things have changed on Gmail's end and adding a new account is no longer allowed due to deficiencies in our OAuth implementation.
If I get ambitious,  I'll try to trace the changes between 45ESR and 52ESR where it uses OAuth2Module.jsm. Unluckily it looks like the whole of mailnews\base\src has changed and probably dom changes as well.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Alfredo Fernández Díaz on May 29, 2022, 10:16:36 am
Note that OAuth 2.0 seems to only be for IMAP and unavailable for POP
OK, that's why I couldn't find the option anywhere -- I had to create a new IMAP mail account under SM for it to be listed.

I'm not big on having my mail permanently stored on Google's servers*, though, so one-time 'application password' it is -- especially seeing that you seem to have trouble with OAuth2 anyway. Of course, they have my phone number now :( but application password seems to work so I can go missing for 36 hours without losing access to the account at just the right moment.

Great, thank you everyone!

*It is, anyway. I don't have "leave messages on server [...]" checked, which I take it to mean messages are deleted when I fetch them (classic POP style) -- but I can still get them from my phone too afterwards (only until tomorrow?).
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dariusz Piatkowski on May 29, 2022, 05:20:09 pm
So here is something else to consider, I do actually have BOTH of these implemented so it may very well be that the combination of the two allow my TB to work quite fine:

1) Application Password
- this is th process Dave highlighted earlier on

2) Secure Application Flag
- in your Google account you have the option to flag a particular app, or create a generic "email app", that basically tells Google "it's OK if this app accesses my data", you can find this under the "Data & privacy => Apps with access to your account" section

Overall I find the Google way of presenting things to be somewhat too-fuzzy, perhaps being an IT person by profession I prefer to see things clearly defined in a config-type setup where various options can be either turned ON or OFF...alas, that's not what the world wants!! lol

Anyways, I thought I'd just toss that out there to paint a fuller picture of what I'm currently using. It's been a while since I implemented that, the only problem I had ran into since was that the Google Contacts TB add-on is marked by Google as a "bad actor" and subsequently I can't get my Contacts list to get updated in TB anylonger.

Even my Google-One subscription was useless, went through multiple agents who all claimed to understand the issue but only continued to "kick the can down the road" to another agent. I gave up after a couple of weeks...
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 29, 2022, 06:21:52 pm

*It is, anyway. I don't have "leave messages on server [...]" checked, which I take it to mean messages are deleted when I fetch them (classic POP style) -- but I can still get them from my phone too afterwards (only until tomorrow?).

Actually Google generally keeps your messages forever, even when using POP with the setting to don't leave mail on the server. It is just marked read and not as easily visible.
You can test by logging into the web interface of gmail and searching for an old message.
I've been slowly moving to gmx.com, simpler to use as they don't do all the security stuff, hosted in Germany so better privacy laws.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Remy on May 31, 2022, 04:11:49 pm
Ising latest Thunderbird build.

Gmail imap only:
- Trying to change from normal password to OAuth under one gmail account, it will not work.
- Trying to add a new gmail account with OAuth, it opens a google logon screen, I could login but then, thunderbird is in a loop
  and it never creates the new gmail account  (it looks like it is hanging due to a gmail account already exist !)
...

? strange...
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on May 31, 2022, 05:25:59 pm
Our implementation is old and likely broken compared to what Gmail and others expect. For example, 52ESR has about 4 times the code to handle OAuth 2.0.
I also came across this, https://www.pmail.com/devnews.htm (https://www.pmail.com/devnews.htm) which makes the claim it is simply broken, overly complex and not really documented
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Alfredo Fernández Díaz on June 01, 2022, 10:12:36 pm
Actually Google generally keeps your messages forever, even when using POP with the setting to don't leave mail on the server. It is just marked read and not as easily visible.
You can test by logging into the web interface of gmail and searching for an old message.
No need to test, I know, that's why I mentioned accessing them from my phone after they were "popped off" from the server -- you wouldn't see them if they had actually been erased.

Speaking of which, I just checked and I lost access from my phone on the 30th because I refuse to use the GMail client or anything but the 'generic' email Android application. I wonder if I will see all previously "deleted" messages when I set up access for it again :DD

Quote
I've been slowly moving to gmx.com, simpler to use as they don't do all the security stuff, hosted in Germany so better privacy laws.
Sure, I don't use gmail for anything that I don't assume will be scrutinized and/or leaked eventually, and I only started using it again when yahoo started bouncing messages from ArcaNoae for no reason.

Would be happy to get rid of both, but it's been years now since their constant attempts to drive lesser players off the game succeeded, and keeping my own email server just became too difficult.

Our implementation is old and likely broken [...] also [...] https://www.pmail.com/devnews.htm (https://www.pmail.com/devnews.htm) [...] makes the claim it is simply broken, overly complex and not really documented.
Which I find even likelier, so yet another moving target.

Anyway, thank you for your support, guys!
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dariusz Piatkowski on June 04, 2022, 06:31:47 pm
Hi Remy,

Ising latest Thunderbird build.

Gmail imap only:
- Trying to change from normal password to OAuth under one gmail account, it will not work.
- Trying to add a new gmail account with OAuth, it opens a google logon screen, I could login but then, thunderbird is in a loop
  and it never creates the new gmail account  (it looks like it is hanging due to a gmail account already exist !)
...

? strange...

Here is what I did to change the TB password from the previously working OAuth to the 'app-specific' Google password:

1) Get the Google 'app-specifc' password generated (see the previous post re: details), set it aside
2) TB => Tools => Options => Security
3) select 'Passwords' TAB => Saved Passwords

Now you will see all the account credentials you've been using so far.

In the same of Gmail I have the following defined:

1) imap://imap.gmail.com (for incoming)
2) smtp://smtp.gmail.com (for outgoing)

...for both of these (they appear in the same window) go ahead and select the 'Show Password' button.

Now you are ready to change the password from the old OAuth verison to the 'app-specific' one that you previously generated and set aside.

To do this, just double-click on the password you want to change (under the 'Password' column), this will switch that field into an EDIT mode where you can now replace as needed.

In my case I have a couple of accounts setup in TB to use Gmail. One is still using OAuth and the other one is using 'app-specific' password. They both work fine!
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: mauro on June 07, 2022, 09:20:54 pm
from my side I can tell that after having created the app password in Gmail settings, Seamonkey mailer handles Gmail account access by this password (stored in the preferences) with no autentication problems, both receiving/sendings.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andreas Schnellbacher on June 08, 2022, 12:18:02 pm
There's a new news entry from Arca Noae: Resolving issues with GMail and OAuth 2.0 requirements (https://www.arcanoae.com/resolving-issues-with-gmail-and-oauth-2-0-requirements/).
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: mauro on June 09, 2022, 11:59:50 am
from my side I can tell that after having created the app password in Gmail settings, Seamonkey mailer handles Gmail account access by this password (stored in the preferences) with no autentication problems, both receiving/sendings.

better explain: when write "no autentication problems" means that autentication is well working  (while it could also be misunderstood as giving issues of no-autentication)
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andi B. on June 16, 2022, 11:24:08 am
As google now disable comfortable access to there mail and calendar I'm moving completely away from this company. I've used there services only for test purposes so no big problem. Anyway I read Arca Noaes hints about new authentication. But I don't like to activate 2-factor authentication cause this would need one of the following if I understand correctly -

- Android device or other device running a Google program on it (which is not possible on OS/2 nor KaiOS and not desirable anyway)
- a FIDO security key which needs to be bought and needs to generate a key anytime I want to update my calendar (unthinkable uncomfortable)
- SMS or phone call for every calendar/email login (beside overly uncomfortable I don't even think about giving this company my phone number voluntarily)

Seems this all is a new step from Google to force the world to use their software or leave their universe. I choice second.

Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on June 16, 2022, 04:01:50 pm

- SMS or phone call for every calendar/email login (beside overly uncomfortable I don't even think about giving this company my phone number voluntarily)

Seems this all is a new step from Google to force the world to use their software or leave their universe. I choice second.

Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.
OAuth 2.0 also did similar with Google verifying it was me, though I made multiple attempts to set up.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andi B. on June 16, 2022, 04:23:12 pm
Quote
Actually, here it is a SMS...
I've read about you can add your devices to 'known secure ones' and then with these devices you wouldn't asked again (= loosing 2 factor authentication and what's the security benefit now?). Moreover this would need to give them one of my mobile numbers. Although SMS should work over conventional telephone network too, I'm pretty sure my provider don't support it.

Quote
...I first used the app password...
Don't get me wrong but I think this is one of the problems I wanted to stress - some people (especially web amateurs) think, everyone has to have an Android phone. Often iPhones are tolerated too. Most of the time only the newest generations. But the world is bigger and more diverse than their horizon ;-).

Let me ask different - is there a way to setup SM/TB for google without using a special Android/iOS program AND without giving them a mobile number? As said, it is not so much important for me as gmail censors emails since a long time and so their service is useless for serious email communication anyway. But for the sake of having trash email addresses for potentially insecure web services gmail was good enough.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on June 17, 2022, 07:10:47 am


Let me ask different - is there a way to setup SM/TB for google without using a special Android/iOS program AND without giving them a mobile number? As said, it is not so much important for me as gmail censors emails since a long time and so their service is useless for serious email communication anyway. But for the sake of having trash email addresses for potentially insecure web services gmail was good enough.

I don't think so as at a minimum, they want to send you a SMS to verify it is you.
Unluckily, it is the way things are going, in the name of security.
The web mail interface does still work here, using the simplified version I believe. Not the best but for occasional use...
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: mauro on June 18, 2022, 08:36:09 pm


Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.


confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Andi B. on June 18, 2022, 08:55:38 pm


Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.


confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dariusz Piatkowski on June 18, 2022, 11:15:47 pm
Andi!

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

...but that's a massive oversimplification of what's going on: if it wasn't for the shortcomings of our platform you would most likely want a two-factor authentication solution!

Since we are unable to use it, we need the kind of functionality app-passwords provide and so how can you 'blame' Google for the lack of security there? Heck...they are doing us all a huge favour by continuing to accept the existence of this security hole!!!
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on June 19, 2022, 04:27:11 am


Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.


confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.

So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?

Well, if someone acquires your Google password, they can't download all your mail without your phone number. Not much of an improvement but still an improvement.
Using OAth 2.0 gives about the same level of security. A lot of it seems like security theatre, "hey we're doing something about making things more secure"
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Jan-Erik Lärka on August 25, 2022, 12:57:46 pm
I'm not impressed by the suggestion to add two stage verification.
I log on from different computers and absolutel don't want them to send anything to my phone every time I need to use thier services.
I've now disabled two stage verification and set google to forward my emails.
Title: Re: How to use OAuth 2.0 on OS/2 SeaMonkey (or ThunderBird) to login to GMail?
Post by: Dave Yeo on August 25, 2022, 05:44:03 pm
That's another way to solve the problem. Note that the phone thing only happens when using a new device, so once for each computer to verify it is yours logging in.