Google is dropping support for "Less Secure Apps" on May 30th, 2022. Will we be able to use Mu4e with Gmail?

Hello, I'm wondering if we will be able to use Gmail and Mu4e with mbsync after May 30th. If no, can someone recommend a good alternative to Gmail that works with Mu4e? Thank you.

I guess yes, because you will be able to create an application specific password

Gah, I hate that all the big tech companies are doing this now. It makes life unbelievably hard and actually makes my interactions *less* secure because I have to resort to terrible unsupported hacks. I still get a "critical security alert" *every single time* I access gmail from wanderlust. My advice is to move away from companies where you are the product and accept that for actual service, you'll have to pay a monthly fee. Personally I use startmail, which is very reasonably priced and has good privacy ratings. It has much more reasonable security defaults than those "consumer friendly" companies and works flawlessly with wanderlust on multiple devices. In an ideal world, we would all be able to access some sort of self-hosted or at least publicly audited free mail server, but alas.

No need to get your panties in a twist. If you are using application that requires POP3/IMAP, you shouldn't have been using your Google password with it since ages ago and should have two factor authentication enabled. And that's what the application specific passwords are for - to enable access for apps that don't support this. If you start using a specific password, you will not be affected by neither the above mentioned Google change nor getting those security alerts. All that Google is changing is that they will be blocking access to the account using your normal Gmail login/password over insecure protocols like POP3 - which is a good thing, given how sensitive access to your e-mail account is. EDIT: Re the self-hosted e-mail server ideal - sorry, that's nonsense. 90% of (even otherwise technical) people have no idea how to properly configure and run an e-mail server so that it doesn't become a relay for spam, viruses or a botnet zombie. It is not a trivial thing these days and managing one requires constant vigilance and maintenance. Worse, if you are running your own server you will have a ton of mail delivery problems because most large companies will routinely reject mail from small domains as possible spam, especially if you are running it from a dynamic address (forget something like DynDNS!). And a "free mail server" - electricity, internet access, storage and server maintenance aren't free. Why should an e-mail service be? How will the operator pay for its operating costs, if it is free?

Here is the explanation of both what is actually changing and what one can do to deal with it: https://support.google.com/accounts/answer/6010255?hl=en If you want to keep using Emacs and Mu4e, the simplest solution is to turn on two factor authentication and to create an app-specific password for it. Then everything works as before.

I don’t know, but I strongly suggest getting your own domain and using that for email, and host it at fastmail, protonmail, or one of the other good options. I prefer fastmail for reasons, here’s my referral link if you want to try it out https://ref.fm/u26310488 Using gmail (or any other email provider like this) puts you at risk of being locked out of your email because their algorithm decided it. And good luck getting that decision reversed in a timely manner.

Yeah, having scoped revocable credentials is way better from a security perspective than "just give the application access to your entire account".

[deleted]

I have a forward rule in my old gmail address that sends it all to my personal address :) now if you want to send from the gmail address it’s a little harder.

[deleted]

O I know, our security staff would not be happy if I forwarded all work mail to my private address :)

Yes, however those options cost money 💸

Given how important access to your email account is, you should never use two-factor authentication with it. The risk of losing access to your account is too high. It certainly isn't a good thing that Google decides about that tradeoff for you.

Precisely. My welfare check doesn't quite allow for fastmail's insane $3/mo, much less a laptop which I stole, or a wifi connection which I'm getting from Panera Bread. I do get harrassed by the manager to make a purchase, but I tell her I'm saving up for fastmail.

Yes they do. It’s usually a few dollars a month, but I understand even that small amount isn’t doable for some. For anyone who relies on email for vital things, then this purchase makes more sense. But if your email were to disappear tomorrow and it wouldn’t really impact you, then keep using an option that you pay for with your data until you can afford one you pay for with money.

Sure, if you have a work email you should use that for work things. But if it’s a university email or something like that, there’s (usually) no rule saying you have to use it for anything beyond the bare minimum. There will always be exceptions, but they are, by definition, exceptional. Most people, assuming they can afford it, should get their own domain and use it for email.

Huh what? So when the account access is important you don't want to protect it and be exposed to phishing and various account hacking problems instead because you fear you could be locked out with the two factor authentication? Talk about fixing a broken toe by amputating the entire leg ... FYI, Google is not completely stupid, they do provide multiple methods how to authenticate in case your normal second factor (e.g. a popup on your phone) is not possible. You get a set of one time backup codes you can use, you can use Google Authenticator, etc.

Yes, when the account access is important you don't want to risk losing it just because you fear phishing. It's a tradeoff. 2FA isn't always the right choice and Google forcing it upon you is not a good thing. I know there are fallback methods but they have to be set up first. Someone who enables 2FA because they are security concious will enable them and all is fine. Someone who enables 2FA just because Google made them will likely lose their account.

>I understand even that small amount isn\342\200\231t doable for some. Enough with the cover-your-bum circumlocution. The only reader of r/emacs who can't spare $3 per month is in prison.

You are beating a strawman. Google *is not forcing 2FA*. If you are not using 3rd-party apps to connect to GMail, this won't affect you in any way and you don't need any 2FA setup - even though it is better to have it. You need 2FA enabled only if you want to use 3rdparty applications that don't understand the Google login protocol and need a simple password. 2FA is a prerequisite for being able to create those app-specific passwords. Concerning setup of the 2FA - I suspect you haven't ever done it with Google. Otherwise you would know that those backup codes you get during the setup of the 2FA system, along with the detailed explanation of how the system is going to work and how to use the codes. And seriously, if someone isn't skilled enough to understand those instructions and know how to save those backup codes, then they certainly aren't going to be better off by keeping their account insecure and using apps that get full access to their Google account. I agree that 2FA is not always the better choice but unless you are a specialist who understands the issues *in detail*, then this is really not a good place to "stick it to the man". FYI, options for 2FA authentication that Google offers: * Use a hardware security key * Log in from another device to receive a security code (e.g. you want to authenticate a computer using your phone) * Message pop-up on your phone or tablet * One time code on a phone/tablet (works even offline) * Code from the Apple authenticator * Code sent by SMS to a phone number that you have in your account (even multiple phone numbers are possible) * One of the backup one-time security codes And finally, there is always an option for a password reset/account recovery. Of course, nobody is forced to use GMail. But spreading FUD is really not helpful here.

> Google *is not forcing 2FA*. If you are not using 3rd-party apps to connect to GMail, So Google is forcing 2FA unless you are not using "3rd party" apps to connect to Gmail. > And seriously, if someone isn't skilled enough to understand those instructions and know how to save those backup codes, then they will not save them and get locked out of their account, losing all their data. > Of course, nobody is forced to use GMail That is 1. not an argument and 2. not quite true. The barrier to switching email accounts is high unless you use your own domain.

/u/janoc writes: >if someone isn't skilled enough to understand those instructions... then they certainly aren't going to be better off by keeping their account insecure I like how this ass clown palmed off circular logic with condescension. Really good stuff. Game recognizes game. From one obfuscatory blowhard to another, I ask /u/janoc to consider everyone reading this thread could give a ladybug's fart about security best practices. The last thing we want to revisit is the nightmare of accessing gmail from emacs.

> Enough with the cover-your-bum circumlocution. I take it you've never been so poor that $3/month matters. https://www.census.gov/library/publications/2021/demo/p60-273.html: > In 2020, there were 37.2 million people in poverty, approximately 3.3 million more than in 2019 (Figure 8 and Table B-1). There are millions of people to whom $3/month matters. You might argue that an insignificant number of them are in r/emacs. I would disagree. On the other hand, if I've completely missed the joke or sarcasm or whatever, please ignore me :)

>There are millions of people to whom $3/month matters. You might argue >that an insignificant number of them are in r/emacs. I would disagree. Given the level of discourse here -- yours being a shining example -- perhaps you're right. Certainly someone whose priorities had gotten so inverted that $3 is an existential difference could easily have decided idling here instead of manning a help desk is a good idea.

So you claim that someone is able to configure a third-party application like a mail client or fetchmail with GMail and yet at the same time don't understand the instruction to save the recovery codes? Seriously? Yes, the barrier to account switching is high with GMail - but that's the same with any other provider and has zero to do with 2FA authentication (you can download and export all your data including e-mails from the website directly). I don't care that you keep downvoting me for no reason but at least try to find a less convoluted and tenuous argument than this nonsense.

> turn on two factor authentication AKA "if your phone stops working or gets lost you get locked out of your email and anything else associated with your Google account" mode. You think it won't ever happen to you, until it does (Android bootloop, anyone?). I can see 2FA's usefulness in organizations with administrators that can fix things when life happens. I don't think 2FA is appropriate for individuals for whom the only recourse is clicking through Google's automated support tree.

> No need to get your panties in a twist. No need for you to be rude. > If you are using application that requires POP3/IMAP, you shouldn't have been using your Google password with it since ages ago and should have two factor authentication enabled. Ah, 2FA, yes, so when my smartphone suddenly goes into a bootloop, I get locked out of my email and everything else associated with my, what, 15-year-old Google account that's never had a single security problem using my long and un-brute-force-able password that is not used anywhere else? But that hasn't happened to you, so it won't happen to anyone else, right? > All that Google is changing is that they will be blocking access to the account using your normal Gmail login/password over insecure protocols like POP3 How are POP3 and IMAP insecure? You know about TLS, right? 2FA is really a way for Google and these other megacorps to force users to give them their cell phone numbers. Then, if your phone breaks, dies, gets lost or stolen, or if there's ever a billing problem with your cell provider, or if someone ever social-engineers their way into porting your phone number away--you lose access to your online life, regardless of whether you have the secure password you've always used to log in. Oh, and you may know all the answers to your security questions too, but if you're connecting from a different IP address or ISP than you used 6 months ago, well, you're probably actually a bad guy trying to steal access to your own account, so get in your car and drive a few hours to somewhere else and try again, and maybe they'll believe it's you. Or maybe not, and maybe you'd better hope you can get access to a local archive of your email so you can send them random subject headers and timestamps to prove that you used to have access to your own email, maybe then they'll believe it's you. Or maybe not, and maybe you'd better host your email with someone that doesn't force you to use 2FA against your will. I say again, 2FA is not appropriate for individuals, only for members of organizations that have administrators who have the power to solve 2FA problems.

How long has email been around? How long have people been accessing their email accounts with usernames and passwords? How long has stuff like fail2ban been around? But suddenly we need to have smartphones and give Google our cell phone numbers and print secret codes and put them in safety deposit boxes and pray that if any number of life issues happen to us we can find the magic incantation to get Google to let us back in to our own account even though we have the password and security question answers that we created ourselves. You think it won't happen to you, until it does, and then you can't access your own email anymore, even though you're using your own computer from your own home with your own username and password that you've used for over a decade, because Google says "no 2FA? No login." Meanwhile, in those many years, my Google account has never been compromised, because I use a secure, unique password. You could learn the hard way, or you could learn from others' experience. Good luck.

Are you u/nnreddit-user's alter ego? Just curious.

[removed]

I have posted this multiple times. You don't have to use it if you don't like GMail (but then why are you bothered by this if you are not using it?). However, it would be extremely helpful if people actually checked how the system works instead of spreading FUD and ranting about it. If your phone goes into a bootloop (or gets stolen or whatever) then you have multiple other ways to get into your account, such as one time security codes that you get when you enable the 2FA access. Moreover, you don't have to use the phone as your second factor at all, even though it is likely the most common option. And if you have never had your account social engineered away from you because some helpful grunt at the support desk got convinced to reset access credentials without actually verifying your identity, then good for you. Others haven't been so lucky. There are plenty of stories available about Google accounts getting hacked and taken over by various methods.

Just using your one phone as the 2FA code device is not a good idea. Sadly though that’s what most websites pushes users towards. Better approaches include: - Use a password manger to store 2FA seeds and let them generate codes for you - Use Authy if you want to keep it separate from your password manager - Backup the QR code and/or seed value somewhere secure when setting up 2FA on an account Any of these should allow you to still be able to sign in to all your things without issue should your main phone die for any reason. Also, let’s not forget 2FA backup/recovery codes. Always save them somewhere secure, and don’t lose them.

> Use a password manger to store 2FA seeds and let them generate codes for you None of the sites I've been pushed or required to use 2FA with have offered to let me do that. > Use Authy if you want to keep it separate from your password manager What's Authy? I don't honestly care, anyway. I don't want to use 2FA--I want to use my username and secure password like I always have. > Backup the QR code and/or seed value somewhere secure when setting up 2FA on an account Yeah, that's great, until you suddenly need it, and then either your secure thing isn't with you, isn't accessible to you (device problems?), or has been destroyed or lost (burglary, fire, flood, tornado, etc). But that's okay, because you still remember the secure password you've typed in a thousand times...oh, wait... > Also, let’s not forget 2FA backup/recovery codes. Always save them somewhere secure, and don’t lose them. See previous. I say again, 2FA should not be forced upon individual users.

> but then why are you bothered by this if you are not using it? I'm bothered seeing people pushing the use of 2FA on unsuspecting users who will someday be bitten by it and get locked out of their accounts. > However, it would be extremely helpful if people actually checked how the system works instead of spreading FUD and ranting about it. I'm not spreading FUD. I'm speaking from first-hand experience, as you ought to have figured out by now. > If your phone goes into a bootloop (or gets stolen or whatever) then you have multiple other ways to get into your account, such as one time security codes that you get when you enable the 2FA access. Moreover, you don't have to use the phone as your second factor at all, even though it is likely the most common option. It doesn't even matter whether there are other options: the point is that access to any or all of them can easily be lost a thousand different ways, and then these dumb, automated systems will not believe that you are you, and you will have no recourse because you are the product, not the customer. > And if you have never had your account social engineered away from you because some helpful grunt at the support desk got convinced to reset access credentials without actually verifying your identity, then good for you. Since when is it possible for a random Google user to actually contact a helpful grunt at the support desk? All I've ever gotten is stonewalled by support.google.com multiple-choice trees. Thankfully, I still had my email accessible on a host that I pay for, that I configured to forward to Gmail. If I hadn't, I'd have been really stuck. The bottom line is that none of us matter to Google, so they have no incentive to help any of us. And the dumber their ML algorithms get, the worse they will treat us. 2FA makes it more likely for users to lose access to their accounts, not less likely.

Apologies, I agree with you that 2FA shouldn’t be forced upon users. However, I can understand why forcing 2FA might be done in some situations, even if I don’t agree with it. Specially when it comes to average not so tech savvy users, it might be simpler to teach them how to use 2FA than teaching them to use secure passwords. As for using a password manager for 2FA, it basically just means you’d use your password manager to scan the QR code instead of the Google Authenticator app. Authy is a app similar to Google Authenticator, but crucially it allows syncing your 2FA seeds across multiple devices. So losing your one phone isn’t an issue anymore in terms of 2FA. I should mention, that personally I’ve been using password managers for over 15 years, and using them to generate unique random passwords for every single website/service/thing I need a password for. And I’ve also been turning on 2FA on everything that supports it for nearly 10 years. Why? Cause I’m paranoid, probably overly so. I don’t know any of my passwords, so without my password manager I’m screwed. But I’m ok with that, it’s a trade off I’ve done for the sake of my security paranoia… lol Edit: Fixed a typo.

> As for using a password manager for 2FA, it basically just means you’d use your password manager to scan the QR code instead of the Google Authenticator app. That's beyond what a password manager does--or even can do, much of the time. What if one uses a command-line tool like `pass` or a GPG-encrypted text file? That's not going to scan a QR code. > Authy is a app similar to Google Authenticator, but crucially it allows syncing your 2FA seeds across multiple devices. So losing your one phone isn’t an issue anymore in terms of 2FA. Well, that sounds nice. Is it FOSS? Because if it isn't, it's a no-go for me. I'm trying to be less dependent on proprietary software and services, for all of the stated reasons. > I should mention, that personally I’ve been using password managers for over 15 years, and using them to generate unique random passwords for every single website/service/thing I need a password for. And I’ve also been turning on 2FA on everything that supports it for nearly 10 years. Why? Cause I’m paranoid, probably overly so. I don’t know any of my passwords, so without my password manager I’m screwed. But I’m ok with that, it’s a trade off I’ve done for the sake of my security paranoia… lol I feel your pain. By the numbers, only a very few of the passwords in my manager I also remember--naturally, the ones I type frequently. (I find that typing them instead of copy/pasting them helps.)

> AKA "if your phone stops working or gets lost you get locked out of your email and anything else associated with your Google account" mode. Ever heard of backup codes? These are ten one-time 8-digit codes (usually) which serve exactly the purpose of recovering access to your account in case your device is broken or inaccessible. Google has an option to create those, so broken device isn't a problem if you're paying attention to your options.

Ever heard of...fire/flood/tornado/theft/injury/accident/forgetfulness? Where do you store *your* backup codes?

the same question applies to any kind of good cryptographically-strong password, which is next to impossible to remember because of its length and the fact that you have different passwords for different services. I mean I can remember 3 such passwords with muscle memory, and I have 73 of those. (unless you have a single password with a different suffix, which is stupid)

"correct horse battery staple"? Anyway, there's a big difference between 1) remembering a few important, strong passwords that you could use to recover access in an emergency, and 2) having to secure and recover long access codes that are not reasonable to commit to memory, ones printed on paper, etc.

Well. DAMN YOU TO HELL GOOGLE! Now I can't use gmail with my Outlook Express 6 anymore.:( ... Time to switch to another email provider.

[deleted]