Google shutting off use of less secure sign-in technology

rcy026

@TimboJones said:

@rcy026 said:
99% of the users do not use this and 99% of the remaining 1% moved on from such ancient functionality years ago anyway.
OAuth has worked well for many many years now, why do people (and especially developers) still think cleartext passwords is a good idea?

99% of the users don't use Outlook 2010, 2013 or 2016? That doesn't sound right. I know lots of people that buy the onetime Office and use it for years until something forces them to upgrade (these people couldn't read or be bothered with app passwords through Admin settings). And this will trigger many upgrades and $$$ for Microsoft.

Lots of Gmail users that use Outlook? I doubt it.
Most people I know that use Gmail check their email in the browser or in a mobile app, none of them will be affected by this in any way.

rcy026

Can we please keep the discussion somewhat related to what is actually happening?
Google is discontinuing the "less secure apps" login, it is not forcing 2FA, facial recognition or anything like that. It does not in any way affect normal user logins, only apps that use ancient technology.
As I said, 99% of users does not use this functionality which clearly shows since almost no one in this thread even seems to know what it actually is.

TimboJones

@rcy026 said:

@TimboJones said:

@rcy026 said:
99% of the users do not use this and 99% of the remaining 1% moved on from such ancient functionality years ago anyway.
OAuth has worked well for many many years now, why do people (and especially developers) still think cleartext passwords is a good idea?

99% of the users don't use Outlook 2010, 2013 or 2016? That doesn't sound right. I know lots of people that buy the onetime Office and use it for years until something forces them to upgrade (these people couldn't read or be bothered with app passwords through Admin settings). And this will trigger many upgrades and $$$ for Microsoft.

Lots of Gmail users that use Outlook? I doubt it.
Most people I know that use Gmail check their email in the browser or in a mobile app, none of them will be affected by this in any way.

I think you're just thinking of personal @gmail accounts and not Google mail under whatever name used in enterprises.

Overwhelming in my experience, regardless of email provider, business users use a desktop mail client, usually Outlook since they have Office. What helps here is the number of people on 365 and not the perpetual 2016.

If you've only ever had gmail, you're probably used to that and fine. But if you started with ISP's email or work account, you're probably used to a desktop client.

rcy026

@TimboJones said:

@rcy026 said:

@TimboJones said:

@rcy026 said:
99% of the users do not use this and 99% of the remaining 1% moved on from such ancient functionality years ago anyway.
OAuth has worked well for many many years now, why do people (and especially developers) still think cleartext passwords is a good idea?

99% of the users don't use Outlook 2010, 2013 or 2016? That doesn't sound right. I know lots of people that buy the onetime Office and use it for years until something forces them to upgrade (these people couldn't read or be bothered with app passwords through Admin settings). And this will trigger many upgrades and $$$ for Microsoft.

Lots of Gmail users that use Outlook? I doubt it.
Most people I know that use Gmail check their email in the browser or in a mobile app, none of them will be affected by this in any way.

I think you're just thinking of personal @gmail accounts and not Google mail under whatever name used in enterprises.

No, on the contrary, my experience with Google and their services comes 99% from helping other businesses. Still, most users use the webinterface on their desktop and an app in their phone. Almost all apps have used OAuth for many many years.

Overwhelming in my experience, regardless of email provider, business users use a desktop mail client, usually Outlook since they have Office. What helps here is the number of people on 365 and not the perpetual 2016.

If you've only ever had gmail, you're probably used to that and fine. But if you started with ISP's email or work account, you're probably used to a desktop client.

True, and most desktop clients today do support OAuth or similar. I know because I'm one of the users that never uses a webinterface to check my email, I simply can not stand it.
You are correct that older versions of Outlook do not support OAuth, but honestly we have to move on sooner or later, we can not stay 20 years behind just because a small portion of users do not wish to upgrade.
And, as Google explains, you can still create an app password and use whatever Office 20-stoneage version you like so this is basically a non-issue even for those users.

Daniel15

A few people mentioned two-factor auth. Restrictions that increase the usage of 2FA aren't bad... The fewer services that support access via two-factor auth, the better. Most major business already enforce that corporate accounts can't be accessed without two-factor auth so IMO it's good that that's spreading to home users.

Ideally things that use 2FA should support hardware keys via FIDO2 or U2F, to prevent the two-factor token from being phished/MitM'd. Maybe one day everything will be phish-proof.

@Arkas said: Why can't I just use a downloaded authenticator without giving away my phone number to G-Spy?

You can use an authenticator... I'm using Authenticator Plus with my Google accounts. It does still sometimes send a push notification to my phone and tablet instead of asking for the auth code from the app, though.

Overwhelming in my experience, regardless of email provider, business users use a desktop mail client, usually Outlook since they have Office.

"Business" Gmail (G Suite Google Workspace) works fine in Outlook if you use Google Workspace Sync for Microsoft Outlook - It supports everything from Outlook 2003 on Vista all the way to the latest Outlook version, using secure authentication.

Smilence

Really?
I just enabled less secure sign-in to use IMAP. System didn't block my action.