OAuth2 and Thunderbird Questions

[BrowseMail]

Hi,

If I use OAuth2 when using a Gmail account with Thunderbird (IMAP), can this be done without setting up "2-Step Verification" in the Google account? Also, if I use OAuth2 can I turn off "Allow Less Secure Apps" in my Google account?

Thanks.

[tanstaafl]

1. Yes. They are unrelated. I use OAuth2 and have never enabled 2 step verification. One reason is that their support for application specific passwords is buggy. See http://forums.mozillazine.org/viewtopic ... &t=3027516 for example.

2. Yes, you can disable "Allow Less Secure Apps" if you use OAuth2 for ALL of your gmail servers, including the SMTP server. Calling using a password sent over a secure connection "less secure" is just marketing spin to encourage use of OAuth2 and/or Googles app. The main difference security wise is that your passwords are no longer available via tools -> options -> security -> passwords -> saved passwords if you use OAuth2.

http://kb.mozillazine.org/Gmail

[BrowseMail]

Thanks for confirming. Although "2-Step Verification" seems to have good intentions, I am not keen on using it as it complicates the sign-in process and am concerned about getting locked out of my account. I might be tempted to give OAuth2 a try in IMAP though - I don't think there is a lot of benefit, but looks like there is no harm in using it with minimal work.

[BrowseMail]

When accessing my Gmail account with a different IP address (for example when using public Wi-Fi and/or using a VPN) via IMAP (Normal Password), Google usually blocks the connection.

Would using OAuth2 help with this issue (by making Google happier that it is me accessing my account - even if my IP address changes)?

[tanstaafl]

I don't know, but suspect not. Do you have two-step verification enabled? I'm wondering if the problem is because you're no longer using a "trusted computer" when using a different IP address.

What sort of error message do you get when it blocks the connection? See http://kb.mozillazine.org/Posting_a_scr ... _the_forum if you want to post a screen shot.

[BrowseMail]

I don't know, but suspect not. Do you have two-step verification enabled? I'm wondering if the problem is because you're no longer using a "trusted computer" when using a different IP address.

What sort of error message do you get when it blocks the connection? See http://kb.mozillazine.org/Posting_a_scr ... _the_forum if you want to post a screen shot.

I don't use "2-Step Verification". However, I am going to try using OAuth2 where possible, so I'll see what happens...

[BrowseMail]

I have found that since using OAuth2, I no longer get blocked by Google when the IP address changes on my device (on both Windows desktop PC and Android tablet).

[tanstaafl]

I'm using a vpn (PureVPN) which changes my IP address whenever I reboot or reconnect. I have OAuth2 enabled (its a IMAP account) and get blocked by Gmail unless I use a white listed IP address provided by PureVPN instead of the mail server name, and I still have to add permanent security exceptions.