Michael wrote:
On Friday, 3 June 2022 02:45:11 BST Dale wrote:
Howdy,
Early this morning Seamonkey could no longer fetch emails. It wouldn't
accept the username and password. I did some searching and it seems
that Google is disabling plain text username and password. Honestly,
sounds like a good idea really. During my searches, most recommended
OAuth2 so I switched to it.
Err ... perhaps not? The use of a browser to delegate sign on is not necessarily a good idea, because it introduces layers of complication and with
it potential vulnerabilities. Random explainer here:
https://medium.com/securing/what-is-going-on-with-oauth-2-0-and-why-you-should-not-use-it-for-authentication-5f47597b2611
I recall some IMAP4 devs complaining about it, but Google pushed on regardless. From the end of May if you want to login to Gmail you have no option but to use OAuth2. I expect this will break some users login if they have not disabled what Google calls "Less secure application access" and shared with Google their mobile phone number and what other *private* information Google wants to know, before it allows you to access your email messages.
I read a portion of your link. It lost me pretty quick. I seem to
recall that the old way, the username and password was sent in plain
text. In other words, anyone could grab it between me and google,
including my ISP plus who knows who else. I'd think that about anything
would be more secure than plain text. There may be better options but I
have to work with what Google supports. If it supports something
better, I'd switch to that. I'm open to better options. I just want to
be able to fetch my emails in a reasonably secure way. BTW, the
password I use for email is not used anywhere else. I use Bitwarden
now, used LastPass before that.
After a while, I noticed it wasn't downloading new emails
automatically. I have it set to check for new messages every 10 minutes
or so. I had to hit the Get Msgs button each time. I'd prefer it to do
it automatically. I tried restarting Seamonkey and even changing the
settings for doing it automatically, in case a config file needed
updating after the switch, still doesn't do it automatically. I'm
attaching a screenshot of the settings.
Does using OAuth2 disable automatically fetching messages or am I
missing some other setting? It worked fine until I switched to OAuth2
so I don't know what else it could be. Is there something better than
OAuth2 that gmail supports? I just picked the first option I found.
Thoughts??
The OAuth2 mechanism will refresh exchange of tokens between client and server
when they expire, but this should be seamless and transparent to the user. If
there is a breakdown in the connection for some time and a token expires, then
depending on the mail client it may pop up a window asking for your login credentials to be resubmitted. It does this occasionally on Kmail, but I have
not noticed it on T'bird, which I believe is similar/same to the mail client of Seamonkey.
Checking for emails every so often on a timer, is separate to authentication/ authorization. Whether you check for email manually, or after a timer triggers it, OAuth2 will kick in on each occasion as the next step. There may
be some bug in Seamonkey. You could try a later version or try T'bird. If that works with the same settings, but Seamonkey doesn't, then by a process of
elimination the issue would be with Seamonkey's implementation.
HTH.
I wouldn't think the two would have any effect on each other either but
the only change I made was how it sends username and password. Heck, at first, I didn't even restart Seamonkey. When I hit the Get Msg button,
it asked for the password and starting downloading several hours worth
of emails. It hasn't asked for it again since I entered it the first
time so it should be able to trigger itself. Your logic makes sense but reality has thrown a wrench into the gearbox. I thought about switching
back but the old way wasn't allowed anymore. So, I can't revert and
test. BTW, I'm using POP3 I think. I actually store my emails locally.
I'm not sure where to go on this. It may be a bug but even that would
be odd since sending username and password should be separate from
triggering a timer. It just doesn't make sense.
Thanks.
Dale
:-) :-)
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)