If you don't have the time or resources to go through this process you can also use this simple proxy of mine, which intercepts the non-OAuth IMAP/SMTP commands and adds OAuth in the background: https://github.com/simonrob/email-oauth2-proxy/
Oauth2 support for GMail
61–70 of 136 posts
Re: Oauth2 support for GMail
#62Once again, i'm glad not to be using GMail.
Yep. All these anti-google complaints sound so useless. What did they expect? These issues are always an entirely self-inflicted problem. Google's terms of service are public, clear, and completely unacceptable. Why people keep using their services is beyond me.
Legacy.
For example, my email is in Google. There are things related to e.g. evidence for litigation from many years back. I have documents shared with me in Google Docs.
Google used to be pretty good about "don't do evil." I've degooglified what I can, but I can't degooglify 100%.
Re: Oauth2 support for GMail
#63I was aware of the security-audit-at-your-own-expense requirement, and I am not a gmail app developer, I just did a drive by of the documentation 1+ year ago...
As a gmail user, this actually seems like a sensible thing. Gone are the days when users are trusted to just click 'allow' to let some random third party access all your data. It turns out, users don't fully understand the ramifications of that, and complain loudly when the 'free personality quiz' they allowed goes and downloads every private email to use for marketing.
So, if I can't give access to my mail to a random untrusted third party, the next best thing seems to be to give access to someone who has at least had their systems audited and who at least has enough money to pay for an audit, meaning they probably have some business plan and can be tracked down by the courts if they mishandle the data.
Re: Oauth2 support for GMail
#64I’ve gone through this process for my email client Kanmail [1]. The third party audit is not required for email clients that run on end users computers and store credentials locally. By the looks of it Pegasus falls into this category and should not have any issues getting approved (still need the YT video and such but the Google team are surprisingly responsive and helpful in my experience). [1] https://kanmail.io
The wording seems to imply that if, on a yearly whim, someone at Google decides to "empanel" a security assessment team, you have no choice, you will not necessarily be asked permission and you will be paying that invoice whether or not you needed that assessment. Do you have evidence - in writing - to the contrary from a Google official? Abridged wording and my non-lawyer interpretation below in case I'm not clear:…
> you will be paying that invoice whether or not you needed that assessment
They don't just send you a bill for $10k. You can opt-out of the yearly audit by removing your use of restricted scopes.
But yes, it is a yearly required audit, and they're serious about it. This limits the kind of apps that can be built on Gmail (basically – no free apps), but it is undoubtedly better for end users.
Having gone through the process, which checks among other things that data can't be resold, tokens are encrypted, user data is really deleted when you say it is, and that Gmail API access is auditable in the event of a breach; these are all good things for users.
(My auditor was so thorough they actually found a high-impact XSS bug in Firefox – the bounty covered part of their fees.)
Re: Oauth2 support for GMail
#65Is gmail removing IMAP too? Why support OAUTH at all when you can use the normal method of logging in with IMAP and an app password?
App passwords are only available for 2fa enabled accounts, while OAUTH is available for everyone. So far I didn't get a clear answer if "the end of less secure authentication methods" means the end of app passwords as well, or only the end of signing into IMAP with your main google credentials.
Re: Oauth2 support for GMail
#66If you don't have the time or resources to go through this process you can also use this simple proxy of mine, which intercepts the non-OAuth IMAP/SMTP commands and adds OAuth in the background: https://github.com/simonrob/email-oauth2-proxy/
Ah yes. The "Just use FTP + curlftpfs + SVN" approach for solving this problem ;-)
That really doesn't help OP as their customers most likely won't be capable to run that.
Re: Oauth2 support for GMail
#67If you don't have the time or resources to go through this process you can also use this simple proxy of mine, which intercepts the non-OAuth IMAP/SMTP commands and adds OAuth in the background: https://github.com/simonrob/email-oauth2-proxy/
Ah yes. The "Just use FTP + curlftpfs + SVN" approach for solving this problem ;-) That really doesn't help OP as their customers most likely won't be capable to run that.
Oh, it's certainly not an excuse for Google requiring this process. However, if you do want to use Pegasus Mail (or any other non-OAuth app/script/email tool, etc) after the end of May, this is a way to do so. I think it's quite a safe assumption that many of the HN audience are capable of using it, too ;-)
Re: Oauth2 support for GMail
#68I haven't seen a single comment (at time of posting this) touching on the cost aspect The cost of the assessment typically varies between $10,000 -$75,000 (or more) depending on the size and complexity of the application As he says, even if Google classed his as a small app (unlikely) "Regrettably, these kinds of fees are far beyond what I can afford, given that I rely on donations from my users to make ends meet: ev…
It looks like this pay-for-play method is going to have a chilling effect on any developer creating an alternative Gmail interface. Same with removing IMAP.
Re: Oauth2 support for GMail
#69Note that this "OAuth2" support is only for gmail. OAuth 2 is not really an open protocol like OAuth (1) was. It's just something the megacorps shoved down the IETF's throat and every implementation is different enough to need different software. OAuth2 is not good for the health of the internet and will lead to even more lock in.
When Google disables imap at the end of the month for gmail (only allowing OAuth2+imap, which is not imap) that's the end of gmail for me.
Re: Oauth2 support for GMail
#70Is gmail removing IMAP too? Why support OAUTH at all when you can use the normal method of logging in with IMAP and an app password?
They are likely removing IMAP. IMAP support is already disabled by default in Gmail
Can you share а link for this statement.
As far as I know IMAP works ok, you just need to use XOAUTH IMAP authentication.