Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.comp.microsoft.windows > #1604 > unrolled thread

Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS?

Back to article view | Back to alt.comp.microsoft.windows

Contents

  Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-20 22:36 +0100
    Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Arlen Holder <spam@nospam.com> - 2022-06-20 23:00 +0100
      Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? cris <cris@removespam.me.com> - 2022-06-20 20:10 -0230
        Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-21 05:16 +0100
          Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Paul <nospam@needed.invalid> - 2022-06-21 01:27 -0400
          Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Chris <ithinkiam@gmail.com> - 2022-06-21 07:10 +0000
            Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Big Al <Bears@invalid.com> - 2022-06-21 08:32 -0400
              Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? nospam <nospam@nospam.invalid> - 2022-06-21 09:02 -0400
                Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-21 16:12 +0100
              Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-21 15:29 +0100
              Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Chris <ithinkiam@gmail.com> - 2022-06-21 21:39 +0000
                Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-22 22:08 +0100
            Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-06-21 15:24 +0100
              Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Chris <ithinkiam@gmail.com> - 2022-06-21 18:10 +0000
                Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Frank Slootweg <this@ddress.is.invalid> - 2022-06-21 18:51 +0000
          Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? gym <no_one@example.net> - 2022-07-11 01:26 -0500
            Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-07-11 17:21 +0100
    Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burns <usenet@andyburns.uk> - 2022-07-13 08:02 +0100
      Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-07-13 14:52 +0100
        Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burns <usenet@andyburns.uk> - 2022-07-13 15:33 +0100
    Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-07-13 18:34 +0100
    Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burnelli <spam@nospam.com> - 2022-07-13 18:38 +0100
      Re: Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS? Andy Burns <usenet@andyburns.uk> - 2022-07-13 19:10 +0100

Page 1 of 2  [1] 2  Next page →

#1604 — Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS?

I use Thunderbird on Windows to access my Google Mail accounts, but on my
Android phone and Apple iPads, I _never_ use the GMail app (for the obvious
privacy reasons which have been discussed many times on the Android ng).

Hence, people like I am who care about our privacy need a non-Google MUA on
our mobile devices that does _not_ create/require any account set up on the
mobile device.

IMHO, if you care about privacy, you don't set up the phone with any
account, and certainly not with any Google Account set up on the phone.
 <https://i.postimg.cc/NG5pHyBx/aurora10.jpg> No need for a Google Account

Yet, you can have a MUA download your email from any mothership, Google
included, where many of us used K9-Mail for that but AFAIK, K9 doesn't
support OAuth2 (and many of us do not want to set up 2FA/2SV on a phone).

Luckily I just learned that FairMail apparently resolved their recent
hiccup in the last 30 days with Google so it's back on Google's repo.
 <https://forum.fairphone.com/t/marcel-bokhorst-calls-it-quits/84970>
 <https://tech.slashdot.org/story/22/05/19/2033249/fairemail-developer-calls-it-quits-after-google-falsely-flags-app-as-spyware>
 <https://www.ghacks.net/2022/05/19/fairemail-developer-calls-it-quits-and-pulls-apps-from-google-play/>
 <https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/page-1087#post-86909365>
etc.

 From the developer himself, dated "May 18, 2022" on XDA Developers:
 "The few euros I receive in return for what's being offered and the 
  fun of developing things are no compensation for the thousands
  of questions I answer every month, for unfair Play store reviews 
  and for stress about unclear Google requirements."

Yet, from the developer himself, this one dated "Saturday June 18, 2022".
 "Version 1.1922 is available on GitHub now and in the Play store 
  test program after Google's approval."
 <https://play.google.com/store/apps/details?id=eu.faircode.email>
 <https://github.com/M66B/FairEmail/releases>

Since Google changed the rules on passwords just recently, this section of
the FairMail FAQ on OAuth2 is of relevance to users downloading FairMail.
 <https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq111>

OAuth for Gmail is supported via the quick setup wizard. The Android
account manager will be used to fetch and refresh OAuth tokens for selected
on-device accounts. OAuth for non on-device accounts is not supported
because Google requires a yearly security audit ($15,000 to $75,000) for
this. 

OAuth for Outlook/Office 365, Yahoo, Mail.ru and Yandex is supported via
the quick setup wizard.

The OAuth jump page exists for when Android App Links are not available,
for example when using a non Play store version of the app, or do not work
for some reason.

OAuth is not supported for third party builds like the F-Droid build.

Since version 1.1859 there is support for custom OAuth. To use custom
OAuth, an XML file containing the server and OAuth data, like the client
secret, should be created and imported. Please see here about how the XML
file should look like. The XML file can be imported via a button in the
debug panel of the miscellaneous settings of the app. To show the debug
panel, debug mode mode should temporarily be enabled. After importing, you
can use the quick setup wizard to configure an account.

Given all of us use Thunderbird on the PC (on this newsgroup anyway), which
can handle the Google Account OAuth2 without 2FA/2SV, what MUA do you
recommend on your mobile device that does not require 2FA/2SF and which
supports OAuth2?
-- 
Anyone who has a google account on their phone doesn't care about privacy.

[toc] | [next] | [standalone]

#1605

On 20/06/2022 22:36, Andy Burnelli wrote:
>
>
> IMHO, if you care about privacy, you don't set up the phone with any
> account, and certainly not with any Google Account set up on the phone. 


IMHO, if you care about privacy, you don't have to use any of the 
electronic products that are connected online, and certainly not any 
Google products including but not exclusive, an Android phone.

[toc] | [prev] | [next] | [standalone]

#1606

On 20/06/2022 19:30, Arlen Holder wrote:

>> IMHO, if you care about privacy, you don't set up the phone with any
>> account, and certainly not with any Google Account set up on the phone. 
> 
> IMHO, if you care about privacy, you don't have to use any of the 
> electronic products that are connected online, and certainly not any 
> Google products including but not exclusive, an Android phone.

A smart way to read email with privacy is using an open source mail client
such as Thunderbird instead of the web browser.

Is a version of open source Thunderbird on mobile devices yet?

[toc] | [prev] | [next] | [standalone]

#1607

Francis S wrote:

> it seems that K9Mail is going to become the new
> Thunderbird for Android:
> https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-thunderbird-for-android/

This is _great_ information which seems to indicate that the Thunderbird
team has acquired the K-9 source and will essentially port Thunderbird to
Android via that K-9 source code and key personnel.

The only problem as I see it with K9 mail today, is the lack of OAuth2.

While most people don't mind giving out their phone number permanently to
Google, I refuse to use 2FA/2SV which means OAuth is all that's left.

If you ask why that matters, I'd respond that most people don't know what I
know about the Google GMail app on Android, probably because most people
don't test the system like I do, and therefore most people _already_ have a
Google Account set up on their phone... but I don't.

But that means I need a mail user agent like Thunderbird on Android,
because if you use the GMail app, not only are your contacts uploaded
_before_ you get a chance to turn that off (last I checked anyway), but
worse (since I don't have a contacts.db sqlite database for that very
reason), the GMail app, the instant you log into it, _creates_ that Google
Account on your Android phone.

Sleazy. (Just wait until you test what the Google Maps app does that's
sleazy when you test the system, but that's for another newsgroup.)

K-9 mail does not play those sleazy games; however, last I checked, K-9
Mail doesn't have OAuth2 incorporated so you can't use it with a Google
Account unless you want to enable 2FA/2SV permanently.

If the TB group adds OAuth2 to K9/TB-for-Android, I'm a happy camper!
-- 
Posted out of the goodness of my heart to disseminate useful information.

[toc] | [prev] | [next] | [standalone]

#1608

On 6/21/2022 12:16 AM, Andy Burnelli wrote:
> Francis S wrote:
> 
>> it seems that K9Mail is going to become the new
>> Thunderbird for Android:
>> https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-thunderbird-for-android/
> 
> This is _great_ information which seems to indicate that the Thunderbird
> team has acquired the K-9 source and will essentially port Thunderbird to
> Android via that K-9 source code and key personnel.
> 
> The only problem as I see it with K9 mail today, is the lack of OAuth2.

I don't think this is as easy as you think.

Google (the party at the other end of this AUTH
scheme), does not give a fuck whether you can
make it work, or not. They don't have a scheme for
greasing the rails so a developer gets their stuff
working. Sure, you can write code, but if you don't
know why the Google end is rejecting your embrace,
you're screwed.

https://github.com/thundernest/k-9/issues/655

    "All my projects have been terminated after Google falsely flagged FairEmail
     as spyware without a reasonable opportunity to appeal. There will be no
     further development and no more support."

The timing suggests K9 hooked up with Thunderbird,
in case Google locks out K9. Think of it as an
insurance policy, a "just-in-case" thing.

What they don't want, is having to use any inferior AUTH scheme.
A second-best scheme.

This has almost nothing to do with writing email clients,
and everything to do with working with evil corporations.

    Paul

[toc] | [prev] | [next] | [standalone]

#1609

Andy Burnelli <spam@nospam.com> wrote:
> Francis S wrote:
> 
>> it seems that K9Mail is going to become the new
>> Thunderbird for Android:
>> https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-thunderbird-for-android/
> 
> This is _great_ information which seems to indicate that the Thunderbird
> team has acquired the K-9 source

There's nothing to acquire K-9 is an open source application. Everyone has
access to source code. 

> and will essentially port Thunderbird to
> Android via that K-9 source code and key personnel.

My guess is they're simply working to make K-9 to have the look and feel of
thunderbird. 

> The only problem as I see it with K9 mail today, is the lack of OAuth2.
> 
> While most people don't mind giving out their phone number permanently to
> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.

There's no need to provide a phone number for 2FA. 

[toc] | [prev] | [next] | [standalone]

#1610

On 6/21/22 03:10, this is what Chris wrote:
> Andy Burnelli <spam@nospam.com> wrote:
>> Francis S wrote:
>>
>>> it seems that K9Mail is going to become the new
>>> Thunderbird for Android:
>>> https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-thunderbird-for-android/
>>
>> This is _great_ information which seems to indicate that the Thunderbird
>> team has acquired the K-9 source
> 
> There's nothing to acquire K-9 is an open source application. Everyone has
> access to source code.
> 
>> and will essentially port Thunderbird to
>> Android via that K-9 source code and key personnel.
> 
> My guess is they're simply working to make K-9 to have the look and feel of
> thunderbird.
> 
>> The only problem as I see it with K9 mail today, is the lack of OAuth2.
>>
>> While most people don't mind giving out their phone number permanently to
>> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
> 
> There's no need to provide a phone number for 2FA.
> 
I always thought 2FA could be done via another email address thus skipping the phone.  I mean, they do have to think of 
those who don't have a phone, right?  Or do I live is a rose garden?

Al

[toc] | [prev] | [next] | [standalone]

#1611

In article <t8sdom$d1v$1@dont-email.me>, Big Al <Bears@invalid.com>
wrote:

> >>
> >> While most people don't mind giving out their phone number permanently to
> >> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
> > 
> > There's no need to provide a phone number for 2FA.
> > 
> I always thought 2FA could be done via another email address thus skipping
> the phone. 

ideally, 2fa uses a totp app, so that nothing is sent to the user.

the 2fa code is calculated locally via the app and must match the code
calculated at the host, both of which use the same algorithm and seed
value, which was generated when the 2fa was enabled.

several password managers support totp and can optionally auto-fill
both the id/pw and the 2fa code for minimal hassle.

even better is to use a physical hardware token (e.g., yubikey) that
plugs into a usb port (or in some cases, connects wirelessly), which is
*very* secure, but too much of a hassle for most people. 

sending a 2fa code via sms or email is not that secure. both can be
intercepted in various ways.

> I mean, they do have to think of 
> those who don't have a phone, right?  Or do I live is a rose garden?

dunno where you live, but they don't think of security. they think of
reducing tech support calls. anything too complicated will confuse
users, resulting in numerous calls and emails about being locked out,
which can easily end up costing more than any potential fraud from an
account breach, as well as consuming tech support resources that could
otherwise be used for more serious problems.

sms is 'easy'. real security is not.

[toc] | [prev] | [next] | [standalone]

#1614

> Meanwhile, I will likely switch from K9 to something like FairMail because 
> Google is requiring OAuth2 support for those who won't switch to 2FA/2SV.

Drat.

Google is a privacy bastard in almost every way possible with their change
as of June 30th to no longer allow basic privacy of an account & password.

In my tests just now switching from K9 mail (which doesn't support OAuth2)
to FairMail (which does support OAuth2), the sleazy process ended up
_CREATING_ that account for Google in the operating system!

I _never_ want my phone to be set to _any_ account. 
Not Samsung. Not Google. Not anyone.

It's a basic privacy thing, since the instant you create an account on an
Android phone, your privacy is toast.

I suspect it will be the same with the Thunderbird port of K9 mail even as
K9 mail _never_ needed to _create_ an account in the operating system.
-- 
If you have any account set up on your phone, you don't care about privacy.

[toc] | [prev] | [next] | [standalone]

#1613

Big Al wrote:

>> There's no need to provide a phone number for 2FA.
>> 
> I always thought 2FA could be done via another email address thus skipping the phone.  I mean, they do have to think of 
> those who don't have a phone, right?  Or do I live is a rose garden?

Maybe I'm a bit too cynical, but I think Google loves 2FA/2SV because they
are desperate to scoop up your phone number but if there's a typical way
for an average user to utilize 2FA/2SV for a split second only and then
have that information _removed_ from Google's servers, let me know please.

However, as far as I gleaned from Andy Burns' information from weeks ago in
this newsgroup, once you give them your phone number, you can't turn off
2FA/2SV and still log in (which means they have it set up forever)... 

Worse, the instant you give Apple 2FA/2SV permission on iOS it's not only
permanent (as in you can never log in without it in most cases) but worse
(far far far worse), *Apple will _never_ allow you to turn _off_ 2FA*.

Essentially for the rest of your life (the life of your identity anyway).
At least Google allows you to turn 2SV/2FA off if you no longer want it.
-- 
To the iKooks, yes, I'm well aware of the short Apple grace period on 2FA.

[toc] | [prev] | [next] | [standalone]

#1617

Big Al <Bears@invalid.com> wrote:
> On 6/21/22 03:10, this is what Chris wrote:
>> Andy Burnelli <spam@nospam.com> wrote:
>>> Francis S wrote:
>>> 
>>>> it seems that K9Mail is going to become the new
>>>> Thunderbird for Android:
>>>> https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-thunderbird-for-android/
>>> 
>>> This is _great_ information which seems to indicate that the Thunderbird
>>> team has acquired the K-9 source
>> 
>> There's nothing to acquire K-9 is an open source application. Everyone has
>> access to source code.
>> 
>>> and will essentially port Thunderbird to
>>> Android via that K-9 source code and key personnel.
>> 
>> My guess is they're simply working to make K-9 to have the look and feel of
>> thunderbird.
>> 
>>> The only problem as I see it with K9 mail today, is the lack of OAuth2.
>>> 
>>> While most people don't mind giving out their phone number permanently to
>>> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
>> 
>> There's no need to provide a phone number for 2FA.
>> 
> I always thought 2FA could be done via another email address thus
> skipping the phone.  I mean, they do have to think of 
> those who don't have a phone, right?  Or do I live is a rose garden?

For 2FA you always have to have *something*. That's what two factor
authentication means: something you know and something you have. Typically,
it's a password and a phone, but it can be different things. 

[toc] | [prev] | [next] | [standalone]

#1619

Chris wrote:

>> I always thought 2FA could be done via another email address thus
>> skipping the phone.  I mean, they do have to think of 
>> those who don't have a phone, right?  Or do I live is a rose garden?
> 
> For 2FA you always have to have *something*. That's what two factor
> authentication means: something you know and something you have. Typically,
> it's a password and a phone, but it can be different things.

Chris is correct that it can be a variety of "different things" that
suffice for 2FA/2SV/MFA/MSV where I'm almost completely unfamiliar with
what those multiple things might be. 

Can someone help us flesh out _what_ those multiple MFA things might be?

Here's a list I came up with searching about where I ask others to help
flesh it out so that we each have a list of what our choices might be.

1. OAuth2 (usually using an on-device Google Account), or
2. Autoforward Google mail to a non-Google account, or,
3. 2FA/2SV/MSV/MFA via a variety of authenticators, such as...
   a. app passwords
   b. Some kind of "2FA/2SV/MSV/MFA authenticator" app, such as...
      FreeOTP Authenticator, Google Authenticator, Authy, FreeOTP+, etc.
   c. USB tokens
   d. Time-based one-time passwords (TOTP)
   e. SMS 2FA 
   f. Use the phone's built-in security key
   g. Use a physical "security key"
   h. Get a one-time security code from another device
   i. Enter one of your 8-digit backup codes
   j. Sign in using QR codes
   k. Set up a "trusted computer" for sign in
   l. Sign in with "google prompts"
Any others?

Since this is slightly off topic of a request to flesh out the MFA methods,
I added this post, with additional URLs to a specific thread over here:
 *Please help flesh out MUA:Google 2SV/2FA/MSV/MFA options*
 *for everyone to benefit prior to June 30th 2022*
 <https://groups.google.com/g/comp.mobile.android/c/DGpa3lgnBf8>
-- 
Posted out of the goodness of my heart to disseminate useful information.

[toc] | [prev] | [next] | [standalone]

#1612

Chris wrote:

>> This is _great_ information which seems to indicate that the Thunderbird
>> team has acquired the K-9 source
> 
> There's nothing to acquire K-9 is an open source application. Everyone has
> access to source code. 

Agreed it's open source under thundernest on github (for one location):
 <https://github.com/thundernest/k-9>

I will simply repeat verbatim what the article said regarding that word:
 "According to Thunderbird's Jason Evangelho, the Thunderbird team 
  *has acquired the source code and naming rights to K-9 Mail*. K-9 Mail
  project maintainer Christian Ketterer (who goes by "cketti" in the OSS
  community) will join the Thunderbird team, and over time, K-9 Mail will
  become Thunderbird for Android."

While I'm no lawyer, it seems (from that anyway) that there's still
"something" to _acquire_ in the legal sense, if that article is accurate.

>> and will essentially port Thunderbird to
>> Android via that K-9 source code and key personnel.
> 
> My guess is they're simply working to make K-9 to have the look and feel of
> thunderbird. 

Here is the Thunderbird blog article on the topic.
 *Our Plans For Thunderbird On Android*
 <https://blog.thunderbird.net/2022/06/revealed-thunderbird-on-android-plans-k9/>
 "Ultimately, K-9 Mail will transform into Thunderbird on Android.
  That means the name itself will change and adopt Thunderbird branding.
  Before that happens, we need to reach certain development milestones 
  that will bring K-9 Mail into alignment with Thunderbird's feature set
  and visual appearance."

Their K-9/TB-A roadmap lists:
 * Account setup using Thunderbird account auto-configuration.
 * Improved folder management.
 * Support for message filters.
 * Syncing between desktop and mobile Thunderbird

Where I'm most interested in an OAuth2 capable MUA, which I "assume" the
first bullet item indicates for K-9 Mail (as 2FA/2SV is, IMHO, a sham).

There's an FAQ but it's pretty light on the details, e.g., I didn't see any
mention of the newsreader ported to Android, but maybe it's in the works.
 <https://blog.thunderbird.net/2022/06/faq-thunderbird-mobile-and-k-9-mail/>

>> The only problem as I see it with K9 mail today, is the lack of OAuth2.
>> 
>> While most people don't mind giving out their phone number permanently to
>> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
> 
> There's no need to provide a phone number for 2FA.

What's the second (factor/step) then for most users who don't use special
hardware and who only have the email address they're trying to log into?
-- 
Posted out of the goodness of my heart to disseminate useful information.

[toc] | [prev] | [next] | [standalone]

#1615

Andy Burnelli <spam@nospam.com> wrote:
> Chris wrote:
> 
>>> This is _great_ information which seems to indicate that the Thunderbird
>>> team has acquired the K-9 source
>> 
>> There's nothing to acquire K-9 is an open source application. Everyone has
>> access to source code. 
> 
> Agreed it's open source under thundernest on github (for one location):
> <https://github.com/thundernest/k-9>
> 
> I will simply repeat verbatim what the article said regarding that word:
> "According to Thunderbird's Jason Evangelho, the Thunderbird team 
>  *has acquired the source code and naming rights to K-9 Mail*. K-9 Mail
>  project maintainer Christian Ketterer (who goes by "cketti" in the OSS
>  community) will join the Thunderbird team, and over time, K-9 Mail will
>  become Thunderbird for Android."
> 
> While I'm no lawyer, it seems (from that anyway) that there's still
> "something" to _acquire_ in the legal sense, if that article is accurate.

The naming rights are definitely something that is protected. Other than
it's simply an agreement between two organisation to work closely together
on a new version. 

>>> While most people don't mind giving out their phone number permanently to
>>> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
>> 
>> There's no need to provide a phone number for 2FA.
> 
> What's the second (factor/step) then for most users who don't use special
> hardware and who only have the email address they're trying to log into?

There are apps that can provide 2FA. Nothing special required. 

[toc] | [prev] | [next] | [standalone]

#1616

Chris <ithinkiam@gmail.com> wrote:
> Andy Burnelli <spam@nospam.com> wrote:
> > Chris wrote:
> > > Andy Burnelli <spam@nospam.com> wrote:
[...]
> >>> While most people don't mind giving out their phone number permanently to
> >>> Google, I refuse to use 2FA/2SV which means OAuth is all that's left.
> >> 
> >> There's no need to provide a phone number for 2FA.
> > 
> > What's the second (factor/step) then for most users who don't use special
> > hardware and who only have the email address they're trying to log into?
> 
> There are apps that can provide 2FA. Nothing special required. 

  Or use backup codes.

  Or/and RTFWP:

'Turn on 2-Step Verification'
<https://support.google.com/accounts/answer/185839>
"...
 Use other verification methods
 ...
 Use backup codes

 You can print or download a set of 8-digit backup codes to keep in a
 safe place. Backup codes are helpful if you lose your phone."

  To be fair/[f|F]rank, it took me all of a few nanoseconds to come up
with this search, which yielded the above result at the very top:

"google account 2-step verification"

[toc] | [prev] | [next] | [standalone]

#1637

On 6/20/2022 11:16 PM, Andy Burnelli wrote:
> The only problem as I see it with K9 mail today, is the lack of OAuth2.
> 
> ,,,
> 
> If the TB group adds OAuth2 to K9/TB-for-Android, I'm a happy camper!

OAuth2 support has been added to K-9 Mail for Android. It is available 
in version 6.200.
https://github.com/thundernest/k-9/releases/tag/6.200

Martin at gHacks has an article about it:
https://www.ghacks.net/2022/07/08/k-9-mail-future-thunderbird-for-android-adds-oauth-2-0-support/

But there is a comment by Artem S. Tashkinov that says:
"It’s implemented via Android’s “Add Account” option and thus I refuse 
to use it."

and a reply by Yash that says:
"...Kinda defeats purpose if at the end of the day I have to use Google 
account on android device to use an email client."

So you might not be so happy... :)

[toc] | [prev] | [next] | [standalone]

#1638

gym wrote:

> and a reply by Yash that says:
> "...Kinda defeats purpose if at the end of the day I have to use Google 
> account on android device to use an email client."
> 
> So you might not be so happy... :)

I _was_ ecstatic.... 

                .... until you said that!

Thank you for finding that jewel for K-9 Mail and OAuth2, and for digging
into whether or not they are like Thunderbird who runs a yearly audit.

Apparently K-9 Mail does NOT run the yearly security audit that Mozilla
clearly runs, and nobody would have expected them to have done so.

But seeking a rainbow in the clouds, this means that for most people on
Android (who likely are like sheep when it comes to setting up the phone), 
_they_ can now use K-9 Mail with OAuth2, just as the rest of us on Windows
use Thunderbird with OAuth2 (but without needing to creat a Google Account
on Windows just to log into a Google email server to read/respond to mail).
-- 
Posted out of the goodness of my heart to thank "gym" for letting all of us
know that K-9 Mail has added OAuth2 (and for digging into the details).

[toc] | [prev] | [next] | [standalone]

#1639

Andy Burnelli wrote:

> Given all of us use Thunderbird on the PC (on this newsgroup anyway), which
> can handle the Google Account OAuth2 without 2FA/2SV, what MUA do you
> recommend on your mobile device that does not require 2FA/2SF and which
> supports OAuth2?

I see that the latest K9 has added oAuth2 support, I've not tried it yet.

[toc] | [prev] | [next] | [standalone]

#1640

Andy Burns wrote:

>> Given all of us use Thunderbird on the PC (on this newsgroup anyway), which
>> can handle the Google Account OAuth2 without 2FA/2SV, what MUA do you
>> recommend on your mobile device that does not require 2FA/2SF and which
>> supports OAuth2?
> 
> I see that the latest K9 has added oAuth2 support, I've not tried it yet.

Thanks for keeping us in the loop, as you always knew a lot more than I did
(and ever will) about the insecurities inherent in OAUth2 (via that video).

Since I, like you, always try to be helpful to the group at large, you can
see my comments and any responses to them at the bottom of Martin
Brinkman's article over here from a few days ago when "gym" gave this link.
 <https://www.ghacks.net/2022/07/08/k-9-mail-future-thunderbird-for-android-adds-oauth-2-0-support/>

Unfortunately, as expected, K-9 themselves likely can't afford the yearly
Google-required Audit so K-9 with OAuth2 support _creates_ a Google Account
on your phone (just like FairMail did, and whose developer told me why they
_hated_ that they had to do that, but Google is insistent and that's that).

The developer even quit the project because of this murdering of privacy by
Google, but then he was talked back into it (read the XDA thread he wrote).

Luckily, Mozilla _does_ appear to pay for the yearly Google-required audit
or Thunderbird would also be creating a Google Account on your computer.

That means maybe Mozilla will pay for that yearly audit for the Android
version they finally come out with - but - there's NOTHING about that in
any Mozilla press release that I've seen yet. Have you?

Bear in mind you can't have privacy on an iPhone because the iPhone
requires a mothership tracking account (to be functional) but you _can_
have the privacy you want on Android because it does NOT require a
mothership account (to be functional).

Having said that you can't have privacy from the mothership if you set up
the phone with a mothership account, I am well aware most people are sheep
led to slaughter when it comes to setting up a computing device.

That means most people won't even _notice_ this additional loss of privacy,
because most people _already_ lost that critical piece of privacy.
-- 
Before the iKooks fabricate that the iPhone is "functional" without a
mothership tracking account, I will pre-empt their fabrications of
imaginary functionality by stating clearly we're not talking about
jailbreaking/rooting and we're not talking about temporary clusterfuck
tricks that can onkly install an app for only a couple of days.

[toc] | [prev] | [next] | [standalone]

#1641

Andy Burnelli wrote:

> Unfortunately, as expected, K-9 themselves likely can't afford the yearly
> Google-required Audit so K-9 with OAuth2 support _creates_ a Google Account
> on your phone (just like FairMail did
Ahh, I didn't realise it worked that way, as I said I haven't tried it because

1) I don't need gmail in my K9

2) They don't support office365 yet which I will require before October, when MS 
will be insisting on oAuth2.

Maybe once K9 is fully b0rged into Mozilla, they will pay google to validate 
their app.  What bullshit ... publish the spec, and just let apps try to meet 
it, if they work let users users run them, if google want some 
gold-tier-approved-app status, make that an option and see how many/few people 
opt for it!

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | alt.comp.microsoft.windows

csiph-web