Re: [gentoo-user] Seamonkey automatic email download after switch to Oauth2

[Michael <confabulate@kintzios.com>]

[-- Attachment #1: Type: text/plain, Size: 2878 bytes --]

On Friday, 3 June 2022 02:45:11 BST Dale wrote:
> Howdy,
> 
> Early this morning Seamonkey could no longer fetch emails.  It wouldn't
> accept the username and password.  I did some searching and it seems
> that Google is disabling plain text username and password.  Honestly,
> sounds like a good idea really.  During my searches, most recommended
> OAuth2 so I switched to it.

Err ... perhaps not?  The use of a browser to delegate sign on is not 
necessarily a good idea, because it introduces layers of complication and with 
it potential vulnerabilities.  Random explainer here:

https://medium.com/securing/what-is-going-on-with-oauth-2-0-and-why-you-should-not-use-it-for-authentication-5f47597b2611

I recall some IMAP4 devs complaining about it, but Google pushed on 
regardless.  From the end of May if you want to login to Gmail you have no 
option but to use OAuth2.  I expect this will break some users login if they 
have not disabled what Google calls "Less secure application access" and 
shared with Google their mobile phone number and what other *private* 
information Google wants to know, before it allows you to access your email 
messages.


> After a while, I noticed it wasn't downloading new emails
> automatically.  I have it set to check for new messages every 10 minutes
> or so.  I had to hit the Get Msgs button each time.  I'd prefer it to do
> it automatically.  I tried restarting Seamonkey and even changing the
> settings for doing it automatically, in case a config file needed
> updating after the switch, still doesn't do it automatically.  I'm
> attaching a screenshot of the settings. 
> 
> Does using OAuth2 disable automatically fetching messages or am I
> missing some other setting?  It worked fine until I switched to OAuth2
> so I don't know what else it could be.  Is there something better than
> OAuth2 that gmail supports?  I just picked the first option I found. 
> 
> Thoughts??

The OAuth2 mechanism will refresh exchange of tokens between client and server 
when they expire, but this should be seamless and transparent to the user.  If 
there is a breakdown in the connection for some time and a token expires, then 
depending on the mail client it may pop up a window asking for your login 
credentials to be resubmitted.  It does this occasionally on Kmail, but I have 
not noticed it on T'bird, which I believe is similar/same to the mail client 
of Seamonkey.

Checking for emails every so often on a timer, is separate to authentication/
authorization.  Whether you check for email manually, or after a timer 
triggers it, OAuth2 will kick in on each occasion as the next step.  There may 
be some bug in Seamonkey.  You could try a later version or try T'bird.  If 
that works with the same settings, but Seamonkey doesn't, then by a process of 
elimination the issue would be with Seamonkey's implementation.

HTH.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]