Groups > alt.comp.software.thunderbird > #5121 > unrolled thread

Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS?

Started by	Andy Burnelli <spam@nospam.com>
First post	2022-06-20 22:36 +0100
Last post	2022-07-13 18:34 +0100
Articles	12 on this page of 32 — 13 participants

Back to article view | Back to alt.comp.software.thunderbird

Page 2 of 2 — ← Prev page 1 [2]

#5622

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-13 08:02 +0100
Message-ID	<jj790nFkgifU1@mid.individual.net>
In reply to	#5121

Andy Burnelli wrote:

> Given all of us use Thunderbird on the PC (on this newsgroup anyway), which
> can handle the Google Account OAuth2 without 2FA/2SV, what MUA do you
> recommend on your mobile device that does not require 2FA/2SF and which
> supports OAuth2?

I see that the latest K9 has added oAuth2 support, I've not tried it yet.

[toc] | [prev] | [next] | [standalone]

#5628

From	Andy Burnelli <spam@nospam.com>
Date	2022-07-13 14:52 +0100
Message-ID	<tamimd$1dlh$1@gioia.aioe.org>
In reply to	#5622

Andy Burns wrote:

>> Given all of us use Thunderbird on the PC (on this newsgroup anyway), which
>> can handle the Google Account OAuth2 without 2FA/2SV, what MUA do you
>> recommend on your mobile device that does not require 2FA/2SF and which
>> supports OAuth2?
> 
> I see that the latest K9 has added oAuth2 support, I've not tried it yet.

Thanks for keeping us in the loop, as you always knew a lot more than I did
(and ever will) about the insecurities inherent in OAUth2 (via that video).

Since I, like you, always try to be helpful to the group at large, you can
see my comments and any responses to them at the bottom of Martin
Brinkman's article over here from a few days ago when "gym" gave this link.
 <https://www.ghacks.net/2022/07/08/k-9-mail-future-thunderbird-for-android-adds-oauth-2-0-support/>

Unfortunately, as expected, K-9 themselves likely can't afford the yearly
Google-required Audit so K-9 with OAuth2 support _creates_ a Google Account
on your phone (just like FairMail did, and whose developer told me why they
_hated_ that they had to do that, but Google is insistent and that's that).

The developer even quit the project because of this murdering of privacy by
Google, but then he was talked back into it (read the XDA thread he wrote).

Luckily, Mozilla _does_ appear to pay for the yearly Google-required audit
or Thunderbird would also be creating a Google Account on your computer.

That means maybe Mozilla will pay for that yearly audit for the Android
version they finally come out with - but - there's NOTHING about that in
any Mozilla press release that I've seen yet. Have you?

Bear in mind you can't have privacy on an iPhone because the iPhone
requires a mothership tracking account (to be functional) but you _can_
have the privacy you want on Android because it does NOT require a
mothership account (to be functional).

Having said that you can't have privacy from the mothership if you set up
the phone with a mothership account, I am well aware most people are sheep
led to slaughter when it comes to setting up a computing device.

That means most people won't even _notice_ this additional loss of privacy,
because most people _already_ lost that critical piece of privacy.
-- 
Before the iKooks fabricate that the iPhone is "functional" without a
mothership tracking account, I will pre-empt their fabrications of
imaginary functionality by stating clearly we're not talking about
jailbreaking/rooting and we're not talking about temporary clusterfuck
tricks that can onkly install an app for only a couple of days.

[toc] | [prev] | [next] | [standalone]

#5630

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-13 15:33 +0100
Message-ID	<jj83eeFk15U1@mid.individual.net>
In reply to	#5628

Andy Burnelli wrote:

> Unfortunately, as expected, K-9 themselves likely can't afford the yearly
> Google-required Audit so K-9 with OAuth2 support _creates_ a Google Account
> on your phone (just like FairMail did
Ahh, I didn't realise it worked that way, as I said I haven't tried it because

1) I don't need gmail in my K9

2) They don't support office365 yet which I will require before October, when MS 
will be insisting on oAuth2.

Maybe once K9 is fully b0rged into Mozilla, they will pay google to validate 
their app.  What bullshit ... publish the spec, and just let apps try to meet 
it, if they work let users users run them, if google want some 
gold-tier-approved-app status, make that an option and see how many/few people 
opt for it!

[toc] | [prev] | [next] | [standalone]

#5631

From	Brian Gregory <void-invalid-dead-dontuse@email.invalid>
Date	2022-07-13 15:41 +0100
Message-ID	<jj83slFlb9U1@mid.individual.net>
In reply to	#5121

If it's a gmail account Google has all the data anyway so it's pointless 
avoiding the gmail app.

-- 
Brian Gregory (in England).

[toc] | [prev] | [next] | [standalone]

#5632

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-13 15:51 +0100
Message-ID	<jj84fuFp03U1@mid.individual.net>
In reply to	#5631

Brian Gregory wrote:

> If it's a gmail account Google has all the data anyway so it's pointless 
> avoiding the gmail app.

I couldn't care less about having gmail inside K9, my interest is because (like 
google) microsoft will be deprecating "normal" username/password authentication 
in a few months, and I want to continue using K9.

[toc] | [prev] | [next] | [standalone]

#5636

From	Andy Burnelli <spam@nospam.com>
Date	2022-07-13 18:38 +0100
Message-ID	<tamvuh$1tg3$1@gioia.aioe.org>
In reply to	#5632

Andy Burns wrote:

>> If it's a gmail account Google has all the data anyway so it's pointless 
>> avoiding the gmail app.
> 
> I couldn't care less about having gmail inside K9, my interest is because (like 
> google) microsoft will be deprecating "normal" username/password authentication 
> in a few months, and I want to continue using K9.

While there are many people like Brian Gregory who can't separate the
concept of setting up a phone with a mothership account, versus a temporary
login that is used momentarily & then immediately disconnected, I'm sure
Andy Burns is well aware of the astoundingly huge differences in privacy
between the two so I won't belabor that issue.

To Andy Burns' point, I agree that it behooves us to figure out the best
way to get out of this change in SECURITY which comes with a loss of
PRIVACY that most, if not all the major players are gravitating to.

It's news to me that Microsoft Office is moving to the same loss of privacy
in favor of a additional security, but I don't understand (yet) why Andy
Burns equated K-9 Mail to Office 365?

Is it because you need to authenticate Office 365 via your Google login
account? Can you explain as if I didn't catch the connection, maybe others
didn't either.

Thanks!
-- 
A conversation on Usenet starts with everyone agreeing on the facts first.

[toc] | [prev] | [next] | [standalone]

#5638

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-13 19:10 +0100
Message-ID	<jj8g49F2iokU1@mid.individual.net>
In reply to	#5636

Andy Burnelli wrote:

> It's news to me that Microsoft Office is moving to the same loss of privacy
> in favor of a additional security

<https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online>

It was news to me too, especially since they accidentally enabled october's 
planned changes at the end of june for "some" accounts and it took a couple of 
phone calls and quickassist sessions to re-enable non-oAuth authentication using 
powershell.

> but I don't understand (yet) why Andy
> Burns equated K-9 Mail to Office 365?

I saw mention of oAuth and 365 in the K9 release notes this morning.

Simply that I currently use K9 with IMAP to read my 365 mailbox on my phone, I 
don't want to lose that ability in october, but at the moment they only support 
"personal" 365 accounts, not business accounts.

> Is it because you need to authenticate Office 365 via your Google login
> account? 

No, I wouldn't want to login to one service using the credentials of anaother 
that way.

> Can you explain as if I didn't catch the connection, maybe others
> didn't either.

I don't know why "personal" 365 works, maybe it adds a hotmail account to 
android and uses that?  I do have a hotmail account used only for testing, 
similar to my email usage of my gmail account, essentially only google send me 
email to that account.

[toc] | [prev] | [next] | [standalone]

#5639

From	"...winston" <winstonmvp@gmail.com>
Date	2022-07-13 14:42 -0400
Message-ID	<tan3mp$2efri$1@dont-email.me>
In reply to	#5638

Andy Burns wrote:
> Andy Burnelli wrote:
> 
>> It's news to me that Microsoft Office is moving to the same loss of 
>> privacy
>> in favor of a additional security
> 
> <https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online> 
> 
> 
> It was news to me too, especially since they accidentally enabled 
> october's planned changes at the end of june for "some" accounts and it 
> took a couple of phone calls and quickassist sessions to re-enable 
> non-oAuth authentication using powershell.
> 

Fyi...it applies to Exchange Online which is a hosted version of MSFT's 
Exchange Server messaging platform for business.
Only applicable for organizations with subscription for MSFT 
365(Business, Basic, Standard, Premium, Enterprise E1/3/5/F3, Exchange 
Online 1/2)
  i.e. does not apply to Microsoft 365(Family[fka Home], Personal and 
stand-alone Office 365 applications)

-- 
...w¡ñ§±¤ñ

[toc] | [prev] | [next] | [standalone]

#5640

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-13 19:46 +0100
Message-ID	<jj8i7iF2q3uU2@mid.individual.net>
In reply to	#5639

winston wrote:

> Fyi...it applies to Exchange Online which is a hosted version of MSFT's Exchange 
> Server messaging platform for business.
> Only applicable for organizations with subscription for MSFT 365(Business, 
> Basic, Standard, Premium, Enterprise E1/3/5/F3, Exchange Online 1/2)

yes, I use 365 business basic.

>   i.e. does not apply to Microsoft 365(Family[fka Home], Personal and 
> stand-alone Office 365 applications)

[toc] | [prev] | [next] | [standalone]

#5649

From	"...winston" <winstonmvp@gmail.com>
Date	2022-07-13 19:50 -0400
Message-ID	<tanlnh$2g8fq$1@dont-email.me>
In reply to	#5640

Andy Burns wrote:
> winston wrote:
> 
>> Fyi...it applies to Exchange Online which is a hosted version of 
>> MSFT's Exchange Server messaging platform for business.
>> Only applicable for organizations with subscription for MSFT 
>> 365(Business, Basic, Standard, Premium, Enterprise E1/3/5/F3, Exchange 
>> Online 1/2)
> 
> yes, I use 365 business basic.
> 
>>   i.e. does not apply to Microsoft 365(Family[fka Home], Personal and 
>> stand-alone Office 365 applications)
> 
> 
Thanks for the update.
That wasn't clear from the earlier references to 'Microsoft Office'

M365 'Personal', as noted work, since not applicable to Exchange Online 
security changes.  Personal is not capable of 'adding' a hotmail account 
to Android without user input.


-- 
...w¡ñ§±¤ñ

[toc] | [prev] | [next] | [standalone]

#5664

From	Andy Burns <usenet@andyburns.uk>
Date	2022-07-14 11:10 +0100
Message-ID	<jja8cgFavb6U1@mid.individual.net>
In reply to	#5649

winston wrote:

> Andy Burns wrote:
>
>> I use 365 business basic.
>
> That wasn't clear from the earlier references to 'Microsoft Office'
Let's face it, Office365 was a pretty weak name to start with, after its first 
long outage I called it Office364.  But then to rename it to Microsoft365 when 
they already had another product called that, people are still reluctant to call 
it by its new name ... no doubt Marketing think they have done a marvellous job.

[toc] | [prev] | [next] | [standalone]

#5634

From	Andy Burnelli <spam@nospam.com>
Date	2022-07-13 18:34 +0100
Message-ID	<tamvli$1ph1$1@gioia.aioe.org>
In reply to	#5631

Brian Gregory wrote:

> If it's a gmail account Google has all the data anyway so it's pointless 
> avoiding the gmail app.

This is an important question as I'm trying to understand how anyone could
possibly say something that is so very wrong - and yet believe it is true.

Q: *Did you ever set up an Android phone _without_ a Google Account?*

If so, do you have any idea how _different_ it is in terms of privacy?
-- 
Posted out of the goodness of my heart to disseminate useful information
where, in this case, most people don't know enough about privacy to know
there is a difference between momentarily logging into something vs having
that something as an integral part of everything you do on a cellphone.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

csiph-web

Windows Thunderbird OAuth2 works for Google Accounts - but what for Android/iOS?

Contents

#5622

#5628

#5630

#5631

#5632

#5636

#5638

#5639

#5640

#5649

#5664

#5634