Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less secure apps and your Google Account

support.google.com

Post reply on HN
Print view View original

251–260 of 272 posts

Re: Less secure apps and your Google Account

#251

Post by rstuart4133 »

jefftk wrote: post #223
michaelmrose wrote: post #220

Earlier quoted context omitted.

You aren't necessarily actually sending it to a third party per se though. Less secure access also enables using software running on your own computer to access your email easily. For example offlineimap and imapfilter. In theory it ought to work with OAuth but damned if I can get it to work and any instructions a few years old are useless because something has changed in the interim. It's actually less hassle to mig…

> Less secure access also enables using software running on your own computer to access your email easily. For example offlineimap and imapfilter. In theory it ought to work with OAuth but damned if I can get it to work and any instructions a few years old are useless because something has changed in the interim. You shouldn't need OAuth; have you tried application-specific passwords ( https://support.google.com/acco…

Oh, so you still support application specific passwords. I couldn't find them when I last looked, or maybe it was because applications just moved to the OAuth2 model and didn't offer the option. I'm pretty sure Thunderbird's calendar extension doesn't.

I didn't ever understand why Google allowed you to enter a password into a random piece of software. In fact I'm still somewhat perplexed by them letting you enter it into a browser, but I guess they could be using the browser DRM module to get some assurance they are dealing with software they can trust.

I guess it's just too hard to make move everything to hardware security tokens. Nonetheless, I don't see an choice in the long term - physical security tokens that don't allow firmware upgrades is where we must end up.

Re: Less secure apps and your Google Account

#252

Post by FujiApple »

jorgesborges wrote: post #135

Oops. I have small web apps that use gmail accounts to send mail via SMTP, but this requires turning on "allow less secure apps". Will this break those apps? I suspected this would happen eventually and it's been finicky the past year or so anyway. It was a lazy solution to begin with -- so, I'm setting a reminder about this for May 20th.

Sadly I believe it will stop working.

I'm in the same boat and have been putting off moving to a Google blessed solution because of the effort required to navigate the bewildering array of documentation, client libraries and authentication mechanisms Google offers.

Much of the documentation and examples Google makes available are targeted at accessing Gmail on behalf of a human user (who has access to a browser) rather than accessing it on behalf of a machine (which does not). Cutting through the noise is half the battle!

I reluctantly spent some time this morning trawling through it and whilst I now have a working solution I couldn't begin to say whether it is the right approach. In the end I decided to ditch SMTP and use the GMail API [1] with a service account [2] setup with domain-wide delegation [3] which is nearly as scary as it sounds.

One caveat of this approach is that I choose to use a service account `key` (not to be confused with an `API Key`!) rather than the Google recommended "Workload Identity Federation" [4] so no-doubt this will be depreciated at some point.

If you must stick with SMTP then [5] is a good resource for showing how to use SASL XOAUTH with an access token to authenticate with Gmail SMTP. Of course, you need to obtain the access token from Google IAM to use this anyway so there is little benefit of doing this vs using the GMail API directly.

[1] https://developers.google.com/gmail/api/guides/sending

[2] https://developers.google.com/identity/protocols/oauth2#serv...

[3] https://developers.google.com/identity/protocols/oauth2/serv...

[4] https://cloud.google.com/iam/docs/workload-identity-federati...

[5] https://developers.google.com/gmail/imap/xoauth2-protocol#sm...

Re: Less secure apps and your Google Account

#253

Post by shakna »

jeffbee wrote: post #205
shakna wrote: post #201

Earlier quoted context omitted.

If your browser's user agent lies outside the "supported" list, you will be presented with a page telling you that your browser is insecure. It's a whitelist. I... Am unsure why you think this is not the case. You can test it. Or look at any of the many articles after Google made the change.

I set my UA to "Bob Dobbs 42.69". It still loads, and it doesn't say "your browser may not be secure" which is what this thread is actually about .

A freshly installed Firefox, with a useragent of "Bob Dobbs 42.69" yields the "Your browser may not be secure" page, for myself. Both within and without a VM.

So, yes, I think I'm speaking to what the thread is actually about.

Re: Less secure apps and your Google Account

#254

Post by whyoh »

malinens wrote: post #209
Maxburn wrote: post #188

This is going to be a big impact for a lot of our customers. The app we use only supports user/pass auth and lots of people set up special sending only gmail accounts to just get it out and not impact security of their orgs commercial gsuite stuff. Fun times ahead.

Shameless plug: move to inbox.eu. We have migration tool to move away from gmail. We use separate auto-generated IMAP password for more secure access via standard IMAP protocol. Auto-generated passwords by our experience are secure and we haven't have problems with account hacking via them

Just a comment: the difference between business and personal accounts is not very clear. It looks like the business account is better, but it's cheaper. Or is that price just temporary? That slow long scrolling of the pages isn't great either. I suggest making some simple comparison table/chart.

Re: Less secure apps and your Google Account

#255

Post by whyoh »

einpoklum wrote: post #192
bcanzanella wrote: post #24

Earlier quoted context omitted.

What are some alternatives?

Here's one survey of alternatives: https://restoreprivacy.com/google-alternatives/ Personally, I use: * DDG for search. * gmx.com as my main email server (not sure it's that great for privacy, ProtonMail is probably better). * OpenStreetMap for maps (caveat: Some info is on Google Maps and not on there) * HereWeGo for car navigation * Thunderbird as my mail client + calendar * I don't publish videos, but otherwise pr…

GMX exposes your IP address in email headers.

Re: Less secure apps and your Google Account

#256

Post by brirec »

Wowfunhappy wrote: post #245
rolandog wrote: post #244

Earlier quoted context omitted.

Have you thought about multiple 2FA devices? To my knowledge, you can use as 2FA w/Google: 1. A prompt on your phone 2. A hardware security key 3. TOTP token from authenticator 4. one of 10 backup codes And you can also have multiple security keys as well, which is useful if you lose one.

A prompt on my phone and an app on my phone come down to the same thing, and I'm not interested in getting a physical hardware security key. The backup codes are one-time use, and there is no way I would keep track of a slip of paper for years without loosing it. I could use my password manager (Bitwarden) as my TOTP generator, and I may eventually do that just to make all of these services shut up. But, wouldn't tha…

I’m not sure about Bitwarden, but 1Password requires quite a few pieces of information to log in on a new computer, because it derives the encryption key from both the hash of your password and the “Secret Key”. Effectively, it still IS 2FA, with the “something you have” factor being a device activated with the secret key and your 1Password OTP. If you don’t sign into your password manager on your computer directly this should be fine. But you do, of course, lose the ability to paste passwords.

Re: Less secure apps and your Google Account

#258

Post by Wowfunhappy »

brirec wrote: post #256
Wowfunhappy wrote: post #245

Earlier quoted context omitted.

A prompt on my phone and an app on my phone come down to the same thing, and I'm not interested in getting a physical hardware security key. The backup codes are one-time use, and there is no way I would keep track of a slip of paper for years without loosing it. I could use my password manager (Bitwarden) as my TOTP generator, and I may eventually do that just to make all of these services shut up. But, wouldn't tha…

I’m not sure about Bitwarden, but 1Password requires quite a few pieces of information to log in on a new computer, because it derives the encryption key from both the hash of your password and the “Secret Key”. Effectively, it still IS 2FA, with the “something you have” factor being a device activated with the secret key and your 1Password OTP. If you don’t sign into your password manager on your computer directly t…

But regardless of how the vault is protected, your password and your otp generator are both stored there, right? If you have access to one, you have access to the other. So, I don’t understand how requiring both to log in to Google improves security in any meaningful way.

Re: Less secure apps and your Google Account

#259

Post by jefftk »

Wowfunhappy wrote: post #258
brirec wrote: post #256

Earlier quoted context omitted.

I’m not sure about Bitwarden, but 1Password requires quite a few pieces of information to log in on a new computer, because it derives the encryption key from both the hash of your password and the “Secret Key”. Effectively, it still IS 2FA, with the “something you have” factor being a device activated with the secret key and your 1Password OTP. If you don’t sign into your password manager on your computer directly t…

But regardless of how the vault is protected, your password and your otp generator are both stored there, right? If you have access to one, you have access to the other. So, I don’t understand how requiring both to log in to Google improves security in any meaningful way.

It's often much easier for someone to manage to get a copy of your password for a specific application than to get a copy of your unencrypted vault.

Re: Less secure apps and your Google Account

#260

Post by malinens »

whyoh wrote: post #254
malinens wrote: post #209

Earlier quoted context omitted.

Shameless plug: move to inbox.eu. We have migration tool to move away from gmail. We use separate auto-generated IMAP password for more secure access via standard IMAP protocol. Auto-generated passwords by our experience are secure and we haven't have problems with account hacking via them

Just a comment: the difference between business and personal accounts is not very clear. It looks like the business account is better, but it's cheaper. Or is that price just temporary? That slow long scrolling of the pages isn't great either. I suggest making some simple comparison table/chart.

Thanks for feedback and I agree with you. Owners of inbox.eu first wanted to market product for less technical small business people.

Now we are moving away from this business model and will give more priority for custom domain e-mail.

Soon we are launching new pricing page with feature list of free/premium personal mailboxes and custom domain mailboxes

Post reply on HN