Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less secure apps and your Google Account

support.google.com

Post reply on HN
Print view View original

201–210 of 272 posts

Re: Less secure apps and your Google Account

#201

Post by shakna »

jeffbee wrote: post #174
shakna wrote: post #170

Earlier quoted context omitted.

No, Google are pretty specific that they have a whitelist of user agents for their properties. [0] [0] https://support.google.com/mail/answer/6557?hl=en&co=GENIE.P...

There's a huge difference between "supported" and "whitelisted".

If your browser's user agent lies outside the "supported" list, you will be presented with a page telling you that your browser is insecure. It's a whitelist. I... Am unsure why you think this is not the case.

You can test it. Or look at any of the many articles after Google made the change.

Re: Less secure apps and your Google Account

#202

Post by bmarquez »

h4waii wrote: post #167
bmarquez wrote: post #159

Earlier quoted context omitted.

> It would be a royal pain to switch now. I know it's tough (migrated off G Suite Legacy myself) but it's probably best for the long run since G Suite accounts have less consumer features (in my case, lack of play store reviews and free Google Voice) and it's unlikely to change. There are many submissions on HN discussing alternatives. Fastmail, Protonmail, iCloud+ (I switched to this), Microsoft 365 are frequently m…

Not being able to review things in the Play Store was a blocker for your free G Suite account? Also I still have a legacy G Suite with Google Voice attached to it which works fine -- and will add additional cost when/if I switch away.

It definitely wasn't the sole reason, but a sign that G Suite wouldn't maintain feature parity with consumer Gmail accounts. There are other features like Google Play library sharing which won't be added.

Yeah, people who used Google Voice early on were exempted from paying for managed Google Voice. It might be possible to port your Google Voice to a consumer Gmail account.

Re: Less secure apps and your Google Account

#203

Post by akshaybhalotia »

dewey wrote: post #145
garblegarble wrote: post #116

Earlier quoted context omitted.

Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access. I avoid them like the plague for this reason. Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

Maybe it's just me but I don't have "Australia going to force my email provider to hand over my data" in my threat model. It's probably worth thinking about that too before hastily switching email providers. Fastmail is a solid provider, with great support and I never had a real issue with them. I give them money, they provide me a good and stable email service.

And then some version of Russia-Ukraine happens with Australia where you are locked out of your email accounts and all bets are off

Re: Less secure apps and your Google Account

#204

Post by malinens »

Google will soon disable free access to legacy free domain mailboxes (G-Suite). When developing migration tool at inbox.eu it was major headache to implement migration from google. You either use web oauth2 login for each mailbox one by one (imagine pain moving thousands of mailboxes), or enable less secure apps option which now works unreliably or use not easy to obtain global service key to have full access to all domain (which admins do not want). Google makes really hard to move to another mailbox provider. I am actually updating migration tool to make it simpler to migrate

Re: Less secure apps and your Google Account

#205

Post by jeffbee »

shakna wrote: post #201
jeffbee wrote: post #174

Earlier quoted context omitted.

There's a huge difference between "supported" and "whitelisted".

If your browser's user agent lies outside the "supported" list, you will be presented with a page telling you that your browser is insecure. It's a whitelist. I... Am unsure why you think this is not the case. You can test it. Or look at any of the many articles after Google made the change.

I set my UA to "Bob Dobbs 42.69". It still loads, and it doesn't say "your browser may not be secure" which is what this thread is actually about.

Re: Less secure apps and your Google Account

#206

Post by tialaramex »

md_ wrote: post #92
habosa wrote: post #72

Earlier quoted context omitted.

In some cases yeah but not for mail. The GMail API is great but to use it you have to spend like $75k on a security review that Google has to approve.

You can use XOAUTH with IMAP just like any other IMAP client (including Thunderbird, as I noted above).

You should be able to use the Bearer Token standard from RFC7628 rather than XOAUTH which is something Microsoft cobbled together, but either will probably work on most systems, just one of them is better documented.

Re: Less secure apps and your Google Account

#207

Post by jsmith99 »

jsnell wrote: post #183
mortehu wrote: post #43

Earlier quoted context omitted.

If it's in an app you don't necessarily get full browser functionality. You just have to trust the app.

Google does not allow oauth from embedded webviews: https://developers.googleblog.com/2021/06/upcoming-security-... So you should never need to trust the app.

Ironically this is more of a problem now on desktop, where eg a website (such as eBay) in Firefox pops up a PayPal login window without an address bar and there is no way to verify the domain without using developer tools

Re: Less secure apps and your Google Account

#208

Post by folmar »

l72 wrote: post #155
amscanne wrote: post #120

Earlier quoted context omitted.

Or using a free authenticator app for time-based codes?

How do you enable this without first giving google your phone number? My understanding is you have to set up SMS 2 factor auth first before you can change it to TOTP.

On a Workspace account you only need U2F token emulator (https://github.com/danstiner/rust-u2f woks fine) and thenn you can setup u2f first and add normal TOTP in second step. But u2f must stay there. I don't have a personal account to try if it works the same.

Re: Less secure apps and your Google Account

#209

Post by malinens »

Maxburn wrote: post #188

This is going to be a big impact for a lot of our customers. The app we use only supports user/pass auth and lots of people set up special sending only gmail accounts to just get it out and not impact security of their orgs commercial gsuite stuff. Fun times ahead.

Shameless plug: move to inbox.eu. We have migration tool to move away from gmail. We use separate auto-generated IMAP password for more secure access via standard IMAP protocol. Auto-generated passwords by our experience are secure and we haven't have problems with account hacking via them
Post reply on HN