From Newsgroup: alt.comp.os.windows-11
Frank Slootweg <
this@ddress.is.invalid> wrote:
VanguardLH <V@nguard.lh> wrote:
Windows Live Mail did not support OAUTH2. Outlook.com/Live/Hotmail
require OAUTH2. Gmail requires OAUTH2, and the option "Allow secure
apps" disappeared.
Yes, Gmail requires OAuth2, but it still has App Passwords as an
alternative. So does Yahoo and probably more (most? all?) providers
which require OAuth2 by default. A mail provider must be rather stupid
to lock out old clients. I have five mail providers and none of them
lock out non-OAuth2 clients.
Gmail has app passwords. Does anyone else? Hotmail/Outlook.com/Live do
not. My ISP's e-mail service requires OAUTH2. I thought Yahoo Mail
required OAUTH2. Over the past decade, OAUTH2 has gradually been the
norm, not the exception.
Is a previously Gmail-issued app password still usable in the same
e-mail client after uninstalling and reinstalling it? Is the app
password tied to the client program, to a particular instance of the
client, or to the host? E-mail clients on different hosts connecting to
the same account have to each get their own OAUTH2 token. Once you get
a Gmail app password, can it be reused across multiple hosts, or even
within multiple e-mail clients on the same host? App passwords aren't
like that? However, we don't know who the OP's wife is using for
e-mail. Might not be Gmail, so app passwords are not an option to
overcome WLM's lack of OAUTH2 support.
I'm not promoting OAUTH2 (a framework) or OAUTH1 (a protocol). I'm anti-OAUTH2. Seems more about overcoming boob users using the same
username while reusing the same simple password string at multiple
domains. OAUTH2 also allows the server to track its users across
clients, and across hosts.
https://en.wikipedia.org/wiki/OAuth#Controversy
Then "OAUTH2 Sucks" by Erin Hammer, lead author and coordinator for
OAUTH2, in his now-13-year old video which is rather amusing:
https://vimeo.com/52882780
There's a reason why his video won't be published at Google's Youtube.
Several times I've read in Usenet, or helped users, where their e-mail
client suddenly stops authenticating to the server despite all the
server settings in their client are correct. Turns out their client
(yes, happens in Thunderbird, too) did not use the refresh token before
the OAUTH2 token (in the client's password cache) to get a new OAUTH2
token before it expired. The user has to either delete the password in
the client's password manager (which is linked to the now-defunct OAUTH2 token), or use an option in the client to discard the current dead
OAUTH2 token to negotiate for a new one (along with a new refresh
token), and, voila, without any changes to server settings their e-mail
client suddenly can authenticate. By the way, without a web browser on
your host (in the e-mail client, or separately), your e-mail client
cannot [re]negotiate for a new OAUTH2 token. A web session is required
for OAUTH2 token assignment. As Hammer says, OAUTH2 sucks.
He said he got WLM working, so his wife is using some e-mail provider
that does not demand OAUTH2, and *later* he revealed his wife uses
POP. Whomever she is using could later demand OAUTH2. Instead of
focusing on an ancient e-mail client, he could set it up for her
now, but should consider future replacement.
You severely underestimate what is/might_be involved in switching
email clients, especially with regard to local email 'archives',
learning curve, customization, etc., etc..
I fully understand Boris' need for continuing to use Windows Live
Mail and find it telling that Winston supports his approach.
I have needed to switch several times - Outlook to Outlook Express to
Windows Mail to Windows Live Mail to Thunderbird - and it has been
anything but fun.
[...]
The data (message store) migration is trivial when using IMAP. In fact,
you don't do anything: just have the new IMAP client connect to the same
IMAP server, and, poof, it's all sync'ed up. Those who like to use POP claiming they have a local copy of the message store are often the same
ones that don't schedule backups to actually ensure they can restore.
Servers do backups. I've had techs restore accounts, or seen where the accounts got restored without me even asking. Users don't backup.
Yeah, a global statement, but the number that backup before every major
event, or on a schedule, are miniscule to those that don't. I can walk
around with high assurance an airplane isn't going to crash into me.
Tell a user to restore from their backups, and get get a blank stare,
like deer caught in headlights.
Yes, there is a learning curve with new software. Considering most
users just use what got deposited onto their computer by an installer,
which wasn't even elected to perform a custom install, if available,
most users don't learn much about a new program. Many never delve into
the configuration options. Been a long time since users had to enter
the server specifics on hostname, port, and protocols. They just tell
the e-mail program the name of their e-mail service(s). Users expect
the client to figure out how to configure and connect.
You and I delve more deeply into new software. For other typical users,
the change in the UI is their biggest challenge. They want their
computer to work like a TV: just use what's on the remote, and they
don't even learn everything the remote can do.
--- Synchronet 3.21a-Linux NewsLink 1.2