Re: oauth to be required for gmail

[David Engster <deng@randomsample.de>]

> In the end I'll likely just set up the oauth credentials and put in
> the necessary software changes, but I have serious considered your
> "real" solution. There are a couple of problems, though. I have a lot
> of gmail-specific coding (perhaps a bad decision on my part) and a lot
> of stuff in the gmail ecosystem. But my fear is that, should I change
> to another provider --- I don't know, FastMail or someone--- they
> might in time go the same route. Eliminating "less secure" login
> methods certainly seems to be trending.

Anything is possible, but I highly doubt FastMail would go that route. I
don't think they even have their own OAuth2 domain. Instead, they
support different forms of two-factor authentication (U2F, OTP, SMS,
Yubikeyk. authenticator apps, etc.). For passwords, they have a very
nice system were you can set passwords separately for each app you're
using. You can view statistics like number of failed logins and remove
passwords if you think they might be compromised. They even still
support unencrypted protocols like FTP (but you need to set a specific
password for it). If I wouldn't self-host, I'd surely consider using
FastMail. From what I can see, they really try to support as many
use-cases as possible.

-David