Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oauth2 support for GMail

pmail.com

Post reply on HN
Print view View original

1–10 of 136 posts

Re: Oauth2 support for GMail

#3

Post by solar-ice »

> and has the ability to access data from or through a third party server

So Pegasus Mail accesses your email from their servers? For reference, they have an entire flow designed so that the auth credentials never touch the app developer's server for desktop and mobile apps - https://developers.google.com/identity/protocols/oauth2/nati...

Re: Oauth2 support for GMail

#6

Post by uniqueuid »

tatoalo wrote: post #4

> [...] including even having to prepare a Youtube video showing my code in action. What?!

This is unfortunately not unprecedented. When you apply for API access to facebook's graph API, you also need to document your app including videos.

Re: Oauth2 support for GMail

#7

Post by jaapz »

pagutierrezn wrote: post #2

misunderstanding? https://twitter.com/wilbowma/status/1526697254140071936?t=45...

I don't think the problem here is that users can still use app passwords instead of OAuth2 - it's that the developer went through the trouble of developing a OAuth2 implementation, went through the necessary laborious steps to submit the application and then was faced with this message:

> The cost of the assessment typically varies between $10,000 -$75,000 (or more) depending on the size and complexity of the application; smaller applications may see costs at a lower threshold of $4,500

That's just bad, but pretty typically google.

Re: Oauth2 support for GMail

#8

Post by rob74 »

acatton wrote: post #5

I'm confused… Why do they want to support the OAUTH flow when they can just the normal app password flow without any change in their code, just documentation for their users. https://support.google.com/accounts/answer/185833?hl=en

Maybe because the first line on the page you linked reads:

> Tip: App Passwords aren’t recommended and are unnecessary in most cases. To help keep your account secure, use "Sign in with Google" to connect apps to your Google Account.

So, for Google, App Passwords are clearly "second class citizens", deemed insecure and not recommended. And, as an app developer, you probably don't want to be seen as recommending an insecure authentication method?

Re: Oauth2 support for GMail

#10

Post by mbwgh »

I had a similar brick wall moment after having written a tool to sync Google Calendar events with the `when` calendar tool (http://www.lightandmatter.com/when/when.html).

Which is why I never published it (although I have been using it for almost two years), and setting it up requires a series of laborious steps of activating the Google Developer Console, creating API keys etc., which I found just to embarrassing to put in a README :)

Post reply on HN