Google has removed k9mail_app from the Play Store [ ] | Hacker News Reader

Google has removed k9mail_app from the Play Store [ ]

twitter.com

37 pointssemanticist17 comments

K9 mail will stop working with Gmail soon anyway, as Google has announced they will be terminating standard IMAP access and other so-called "insecure" methods, in favor of their proprietary "Sign in with Google" system, or OAuth2. The hostility is beginning to take the shape of a pattern.

IMAP auth is arguably insecure and a leak in Google's otherwise strong authn and authz customer facing systems, although I would be more supportive of the move if they supported the open JMAP standard [1] (championed by Fastmail) instead of their own REST API. Beggars can't be choosers I suppose, but if you support open standards, patron organizations that support open standards.

[1] https://jmap.io/

[2] https://fastmail.blog/open-technologies/jmap-new-email-open-...

EDIT: (can't reply, HN throttling) @kop316 I'm aware, having worked at a SaaS that integrated with Google's APIs.

Please see:

https://github.com/M66B/FairEmail/blob/master/FAQ.md

``` (111) Is OAuth supported?

OAuth for Gmail is supported via the quick setup wizard. The Android account manager will be used to fetch and refresh OAuth tokens for selected on-device accounts. OAuth for non on-device accounts is not supported because Google requires a yearly security audit ($15,000 to $75,000) for this. You can read more about this here. ```

https://www.theregister.com/2019/02/11/google_gmail_develope...

When I was using Android without Google Play, I was not allowed to access my School's email due to this.

They have also been locking down "insecure web apps" from being able to log into Google Accounts, so it makes it much more difficult for browsers other than Firefox or Chrome (e.g. browsers on Mobile Linux Phones) to sign into Google.

K9 has already stopped working some places or requires hoops to be jumped through at others because no one has stepped up to implement SASL XOAUTH2 authentication for their IMAP implementation. Moving to requiring OUTH2 authentication isn't something restricted to Gmail. Many email providers have or are switching to only allowing OAUTH2 authentication.

I think that there's nothing stopping K9 from working with XOAUTH2/gmail, except that someone needs to put in the work. I implemented it a few years ago for a webapp, and it's not so bad. I don't especially like XOAUTH2 as a system or that it's being enforced now, but it's entirely possible to be interoperate with XOAUTH2, and I don't see how it's "proprietary".

How much are you willing to accept as a bug bounty to implement this for K9?

I don't even have a smartphone, much less an Android phone.

Not great, but people may still want to install an imap client from the play store to use with other email providers.

Ouch. This will mess up my workflow and work email accounts—they all seem to find GSuite irreplaceable.

I know it's not ideal and goes against the spirit of open standards like IMAP - but in the end, it's just implementation details. What's stopping K9 from implementing additional connectors for popular services (such as gmail) that are not available through POP3 or IMAP?

The writing is on the wall:

If you value choice and open ecosystems, do not invest in a future where you rely on Google apps any more than you need to.

Big G will burn you and not care at all.

I mean, it almost makes sense. A client that is not just a facade for some proprietary backend? In 2022? Preposterous!

Well, I hope they sort this out. K9 is my "Plan B" after my GAFYD/Google Workspace free subscription is terminated. Keep the email address, but necessarily off Google and off their native email client. Mostly because I still want push mail aka IMAP IDLE, which works (tested it) with my chosen replacement mail provider and K9.

Can I ask what provider you went with? Do they support tags in a similar way to Gmail?

I don't use them and doubt it, but it's Purelymail. So far only a test account with another domain that I have. They give you a little bit of free credit to start experimenting, and have a number of domains you can use.

Anyway the combination of Purelymail and K9 works. Instant email alert even when the phone is "asleep".

Apparently no one at Google can believe that there is such a thing as software that doesn't require an account.

You do require an email account for K9; I guess that's what they're asking for in their canned reply. Someone tried to review it, saw they can't use it without setting up an email account, clicked the standard "reject" reply, and here we are.

Reply on news.ycombinator.com