Re: oauth to be required for gmail

[David Engster <deng@randomsample.de>]

> My point is that it is pretty much impossible to complete that
> sequence without a complete, Javascript-enabled web browser.  But that
> mode, while ridiculously complex, still isn't as pointless as the
> approach with static password that is not actually secret and thus
> does not serve any purpose at all.

The real solution would be if Google supported RFC 7591 and RFC
7628. This is also what the comment above the hard-coded credentials in
Thunderbird says. I predict this will never happen because the providers
are actually quite happy with the current situation. It allows them to
control which applications may access their services, and it pushes more
users away from using third-party desktop mail client. Remember that
Google wants you to use the web while being logged in, since this makes
it much easier for them to track you.

I think the "solution" is to tell users they need to set those
credentials themselves. There are no widespred OAuth credentials which
we could simply use without being shady. The real solution of course is
that users simply stop using Google Mail and choose a proper mail
provider.

-David