Hacker News Reader

Comment by speleding | Hacker News Reader

Perhaps the headline is a bit hard to parse, but OAuth will NOT be required for email, IMAP and POP will continue to work with App Passwords

View on HN

From Google's own official documentation:

"Tip: App passwords aren’t recommended and are unnecessary in most cases."

"Tip: Don’t create an app password unless the app or device you want to connect to your account doesn’t have 'Sign in with Google.'"

"To help protect your account, we revoke your app passwords when you change your Google Account password."

"Tip: If the app offers 'Sign in with Google,' we recommend you use that feature to connect the app to your Google Account."

"If you use a non-Google app and can't sign in, the app's sign-in process might not be secure. Try to update to the latest version of the app and use 'Sign in with Google,' if it’s an option."

Yeah, no problem at all. I'm sure it's going to work flawlessly and effortlessly.

My SO uses GMail and anything but Thunderbird it's a hellish nightmare to setup. On the HN comments about "but my secUrity"... who cares. Get a good and long password and use TLS everywhere. This is enshittification and pure EEE tactics against public standards and free sofware email clients and yet these careless users applaud it.

The nice thing with public standards is that you do not have to patronize providers who do not comply with the standards.

For now. They've been threatening to remove App passwords for a long time.

Thank you, where have they mentioned a possible removal of App passwords?

We use gmail at work and they warned our IT department that App passwords were deprecated and would be removed at some point (there was a previous deadline but it has been extended to a non-specific point in the future).

We had the same communications with Google that encouraged us not to use App Passwords, and hinting at a future removal. Plus the fact that App Passwords expire when the Google Account password changed, means you can’t count on the App Password working.

We are a large enough organization with that we have 25 years of use cases beyond “People Reading in their Inbox”. Printers and scanners have been mentioned. But we also have email used to automatically move data between systems.

Sometimes this is due to limitations of third party systems, sometimes we have to decide does it make sense to invest the time to rewrite a well tested tool that uses POP.

So we have decided to a standards based POP, IMAP, SMTP email service for these automated systems. It takes much less time to configure and test swapping POP server info than migrating to OAUTH

The end user email stays with Gmail.

I see, thanks.

Reply on news.ycombinator.com