[Emacspeak] Re: Loss of Access to Gmail - Text Mode

[Tim Cross <theophilusx@xxxxxxxxxxx>]

"D.J.J. Ring, Jr. via Emacspeak" <emacspeak(a)emacspeak.org> writes:

> Users of Mutt and Alpine have lost access to their gmail accounts, the
> recovery process wants people to sign in with another computer that
> has graphical interface, the problem is that many blind users do NOT
> use anything but text mode.
>
> This question is probably off topic for this list, but the users of
> this list probably know the answer to this question, so if it would be
> permitted.
>
> What nationwide email service still allows email to be sent and
> received without oauth - like gmail used to do only days before?
>
> I'm trying to help a fellow list member who finds himself in this very
> situation, he doesn't have a GUI, and if he logs into his account
> using a GUI (I logged in for him as he gave me his password), google
> wants to verify that it's him
>
> The ways he has to do this are:
>
> Open a browser on a phone or computer where you’re already signed in
> and go to: https://g.co/verifyaccount
>
> Since, like many visually impaired users won't work because many don't
> use a gui and many don't leave the account already signed in if they
> do.
>
> He has no cell phone, so that option is out, and google is notorious
> for not supplying a contact number to fix things, the solution that
> finally appears is "there is no way we can verify your account."
>
> Frustrating isn't it?
>

I think there is some confusion and misinformation going on here. I will
try to clarify. 

Google announced some time back (i.e. 2017/2018) their intention to
remove the ability to access imap and smtp using their normal Google
password. The main reason for this is their intention to get everyone to
use 2 factor authentication (2FA). In fact, 2FA is enforced for all new
Google accounts. 

The thing about 2FA is that it doesn't work with older protocols which
expect just a username and password to perform authentication. Google
has provided two solutions for this problem. 

The first and preferred solution is based on the oauth2 protocol. This
protocol is based on exchange of various tokens and is heavily web
architecture influenced. It is also how most modern mail clients
authenticate. Due to Google terms and conditions, there are a few small
problems for open source projects in being Google oauth2 compliant. The
main one being that the program needs to be assessed and approved by
Google and then issued with an application ID which the program now uses
in the authentication process. Without going into too many gory details,
this is a problem because you also are supposed to keep the application
ID secret, but how do you embed a secret ID in an open source program? 

Note that there are ways to get various traditional programs to work
with the oauth2 framework. Unfortunately, most of them are fairly
clunky, require some technical expertise and are overall inconvenient. I
also believe some open source programs are ignoring the T&C requirements
and just embedding the application ID in the sources (e.g. Thunderbird
and I was told most recent builds of Mutt, but hav enot confirmed this). 

The good news is there is a much easier solution and one I've been using
since Google first introduced 2FA (over 12 years or so), application
passwords. 

To use application passwords, you have to enable 2FA on your Google
account. Once you do, you then have to login to your Google settings
page and create an application password. When you do this, Google will
create a random password string which you need to record somewhere safe.
You then just need to update your various configurations to use that
password instead of your normal Google password and everything will work
as before. 

Note that if your not using 'real' google i.e. your University or
business uses hosted Google mail, the application password feature may
or may not be enabled. In that situation, you would need to speak to
your sys admins to work out a solution.