I see that both Tbird and Bbird have switched from "Normal password" to
"OAuth2" authentication.
I'm wondering why just now, how will this affect things other than
B/Tbird, is it a change that will stay.

Ed

Ed Cryer wrote:

> I see that both Tbird and Bbird have switched from "Normal password" to
> "OAuth2" authentication.
> I'm wondering why just now, how will this affect things other than
> B/Tbird, is it a change that will stay.

When you say "switched", TB has supported oAuth2 since before gmail
started requiring* it.

I don't think oAuth2 is TB's default, what makes you think anything has
changed recently?

[*] OK not exactly required, but certainly easiest.

On 1/24/2024 6:00 AM, Ed Cryer wrote:
> I see that both Tbird and Bbird have switched from "Normal password" to
> "OAuth2" authentication.
> I'm wondering why just now, how will this affect things other than
> B/Tbird, is it a change that will stay.
>
> Ed

For my mail account, authentication is still "Normal password" for the
POP Mail Server and the Outgoing Server (SMTP).

Ed Cryer wrote:
> I see that both Tbird and Bbird have switched from "Normal password" to
> "OAuth2" authentication.
> I'm wondering why just now, how will this affect things other than
> B/Tbird, is it a change that will stay.
>
> Ed

That's not a requirement coming from Thunderbird or Betterbird, but from
your Mail Service Provider. Thunderbird has supported OAuth2 for years.

I know that Gmail uses OAuth2, and Microsoft has strong preference for
it, although I don't know if consumer-grade Outlook requires it. With
corporate-grade setups, my impression is that mail admins can choose to
require or not.

OTOH, there are other implementations of some form of Multi-Factor
Authentication, typically an application password. I know that Yahoo
does this, where the defined user password is used for web-based access,
but where you have to get a separate password for use with IMAP/POP/SMTP.

If your provider is now requiring OAuth2, consider that to be a
permanent thing, and will apply to any client you decide to use.

Smith

On 1/24/24 16:05, NFN Smith wrote:
> Ed Cryer wrote:
>> I see that both Tbird and Bbird have switched from "Normal password"
>> to "OAuth2" authentication.
>> I'm wondering why just now, how will this affect things other than
>> B/Tbird, is it a change that will stay.

<snip>

> I know that Gmail uses OAuth2, and Microsoft has strong preference for
> it, although I don't know if consumer-grade Outlook requires it.  With
> corporate-grade setups, my impression is that mail admins can choose to
> require or not.
>
> OTOH, there are other implementations of some form of Multi-Factor
> Authentication, typically an application password.
OAuth2 authentication has got nothing to do with 2-step authentication.
These are entirely different things.

> I know that Yahoo
> does this, where the defined user password is used for web-based access,
> but where you have to get a separate password for use with IMAP/POP/SMTP.

Yahoo used to use app passwords. But they also do support OAuth2
authentication for quite a while now. With that no app passwords are
needed anymore. With OAuth2 the main account password must be used.

On 1/24/24 01:27 PM, Christian Riechers wrote:
> With OAuth2 the main account password must be used.
Once to set up. Then the setup alters TB and puts in the scrambled
password. You can see it in settings, but don't change it.
--
Linux Mint 21.2 Cinnamon
Al

On 1/24/24 19:52, Big Al wrote:
> On 1/24/24 01:27 PM, Christian Riechers wrote:
>> With OAuth2 the main account password must be used.
> Once to set up.  Then the setup alters TB and puts in the scrambled
> password.  You can see it in settings, but don't change it.

TB doesn't alter anything. With OAuth2 authentication TB remembers an
OAuth2 authentication token, not the account password. The token expires
after some time, and you'll then be prompted again for your credentials.

Andy Burns wrote:
> Ed Cryer wrote:
>
>> I see that both Tbird and Bbird have switched from "Normal password"
>> to "OAuth2" authentication.
>> I'm wondering why just now, how will this affect things other than
>> B/Tbird, is it a change that will stay.
>
> When you say "switched", TB has supported oAuth2 since before gmail
> started requiring* it.
>
> I don't think oAuth2 is TB's default, what makes you think anything has
> changed recently?
>
>
>
>
> [*] OK not exactly required, but certainly easiest.
>

A couple of days ago I started getting the "enter password" dialogue in
Bbird for my old hotmail account. I'd made no changes recently.

Looking at Settings I saw that there'd been a move from "Normal
password" to "OAuth2". I certainly didn't do that.

Shortly thereafter I saw that Bbird had an update in the pipeline.

Ed

Christian Riechers wrote:
> On 1/24/24 16:05, NFN Smith wrote:

>
>> I know that Yahoo does this, where the defined user password is used
>> for web-based access, but where you have to get a separate password
>> for use with IMAP/POP/SMTP.
>
> Yahoo used to use app passwords. But they also do support OAuth2
> authentication for quite a while now. With that no app passwords are
> needed anymore. With OAuth2 the main account password must be used.

It's been several years since I last looked at my Yahoo configs. I'm
not surprised that they're supporting OAuth2, although they're not (yet)
forcing use, and I've had no problem with creating a Yahoo IMAP
connection on an alternate setup, using the app password.

I've done enough with Microsoft-based stuff that requires OAuth2, that
I'm comfortable with it, and once I got used to the extra pop-up that is
used to create the extra authentication token, I think it's easier than
the app password. My primary mail provider still uses the app password
approach.

Smith

On 1/24/24 01:58 PM, Christian Riechers wrote:
> On 1/24/24 19:52, Big Al wrote:
>> On 1/24/24 01:27 PM, Christian Riechers wrote:
>>> With OAuth2 the main account password must be used.
>> Once to set up.  Then the setup alters TB and puts in the scrambled
>> password.  You can see it in settings, but don't change it.
>
> TB doesn't alter anything. With OAuth2 authentication TB remembers an
> OAuth2 authentication token, not the account password. The token expires
> after some time, and you'll then be prompted again for your credentials.
You're right. By alter, I was implying that the real password was
replace as you say with the OAuth2 password.
--
Linux Mint 21.2 Cinnamon
Al

On 24/01/2024 19:14, Ed Cryer wrote:
> A couple of days ago I started getting the "enter password" dialogue in
> Bbird for my old hotmail account. I'd made no changes recently.
>
> Looking at Settings I saw that there'd been a move from "Normal
> password" to "OAuth2". I certainly didn't do that.
>
> Shortly thereafter I saw that Bbird had an update in the pipeline.

I think Microsoft now require Oauth2 for applications to access hotmail.

--
Brian Gregory (in England).

On 1/24/24 2:14 PM, Ed Cryer wrote:
> Looking at Settings I saw that there'd been a move from "Normal
> password" to "OAuth2". I certainly didn't do that.

Thunderbird may automatically update accounts to oauth *if* the mail
provider supports it.

Wayne wrote:
> On 1/24/24 2:14 PM, Ed Cryer wrote:
>> Looking at Settings I saw that there'd been a move from "Normal
>> password" to "OAuth2". I certainly didn't do that.
>
> Thunderbird may automatically update accounts to oauth *if* the mail
> provider supports it.

OK, but I wish they'd let me know beforehand.
I sussed it quite quickly, but I suspect there are others who didn't.

Ed