Google forced OAuth2 because Simple authentication is absolutely terrible.

ForHackernews 2 hours ago | parent | next [-]

There's absolutely nothing insecure or wrong with app passwords for a local client application.

The whole point of OAuth2 is to allow logging in to some untrusted 3rd party site via an authentication provider without having to key your password into the 3rd party site.

a) Local client software like Thunderbird is/must be trusted, it's not a random 3rd party website.

b) App passwords remove the risk of Thunderbird stealing your password, even if for some reason you didn't like typing a password into Thunderbird.

c) Google is both the Authentication Provider and the Resource Server in this example, so it adds zero security.

▲

leni536 2 hours ago | parent [-]

App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.

	▲	ForHackernews 2 hours ago \| parent [-]
		I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped. An app password is basically just an API token, it's up to the backend what powers it grants.

▲

NoidFonsense 2 hours ago | parent | prev [-]

Whats so bad about it