Zoho Mail two factor authentication circumvented by using desktop client

Hi there!

Zoho Mail Desktop App is more like a web browser where OTP is mandatory in addition to the account login password. However, if you've selected ‘Trust this application’ check box earlier, for a certain time frame (probably for about 180 days), the app will allow you to login into your account using account login password itself (i.e., without entering the OTP).

If you have already selected this option while accessing via Desktop app, do let us know about it in an email to support@zohomail.com so that we can request our technical team to debug further. Also, we'd like to clarify that there are no open security issues in our service. We always take security very seriously and have developed a comprehensive set of practices, technologies and policies to help ensure our users data is secure.

Regards, The Zoho Mail Team

Never impressed with Zoho, so not surprised.