Re: oauth to be required for gmail

[David Engster <deng@randomsample.de>]

>>>>>> On Mon, 16 Dec 2019 09:48:58 -1000, Bob Newell <bobnewell@bobnewell.net> said:
>
>     Bob> Aloha,
>     Bob> I'm sure many of you received Google's email this morning
>     Bob> announcing an eventual end to non-oauth access to gmail. There
>     Bob> are various dates starting in February 2020 and extending into
>     Bob> 2021 depending on the situation, but this will pose a problem
>     Bob> for those of us who rely on directly sending/receiving with
>     Bob> gmail via gnus.
>
>     Bob> Note I'm not talking about offline/download solutions but
>     Bob> direct access through gnus.
>
>     Bob> There is gnus-gmail-oauth.el on github, almost four years
>     Bob> old. I haven't tried it and it may not work for both sending
>     Bob> and receiving. Perhaps there are other things.
>
> I think the canonical package for doing this is
> <https://github.com/ccrusius/auth-source-xoauth2>, although I haven't
> tried it yet.

There is the 'oauth2' package in ELPA. I use it for org-caldav and it
works fine.

The problem with OAuth2 is not the technical side, which is pretty easy
to do. The problem is that OAuth2 allows the serving side to control
which application may access their services. They may forbid it
entirely, or they may limit the API access depending on the application.
They can do this since you need to register your application (in this
case with Google), and you get a "client ID" and "client secret" with
which your application identifies itself. AFAIK, for accessing GMail,
you even need to go through an additional verification process to get
full access.

Of course, the "client secret" is pointless if you openly put it into
your source, so there is no way to register an "official" client
ID/secret for Gnus which anyone could use. Last I checked, publishing
the client secret would be considered a violation of Google's services,
with all consequences this may imply (terminating the developer's
account, etc.). So usually, each user needs to register the application
separately; this works for org-caldav, since the CalDAV API does not
require additional verification, but this may very well be different for
the Mail API. It's been some time since I dealt with this, so maybe
things have gotten better in the meantime.

-David