OAuth

[LunarMist]

https://www.att.com/esupport/article.html#!/email-support/KM1240462

It appears that I will no longer be able to access my emails with Outlook 2013, 2016 or the Thunderbirds, etc.
All I can find easily on the OAuth is about servers and technical stuff. Will all email services start using this system soon?
Is there an explanation of this system that I can understand from the consumer privacy perspective?

 

[Chewy509]

It looks like AT&T are updated their authentication technology for direct connections, either:
a, update to a client that support OAuth authentication, OR
b, create a Secure Email Key and use this in lieu of your normal password when configuring IMAP/POP3 access in your current email client.

https://www.att.com/esupport/article.html#!/email-support/KM1240308?gsi=5msjyd

Nothing special about the latter, it's just a fancy way of saying 'rather than using your normal password for IMAP/POP3 access, we create a unique password for that access method'.

(Note: The latter is what Google require you to use, if accessing gmail via IMAP/POP3).

 

[time]

Gmail/GSuite still lets you disable that annoyance:

Settings - Google Account Settings - Security - Less secure app access

AFAIK, it's only useful if your phone is stolen - and you don't have a lock on your phone. Happy for someone to logically explain how a separate password helps otherwise.

 

[LunarMist]

What prevents the OAuth from reading the emails or distribution of the passwords?

 

[Handruin]

The OAuth is just a token system that allows you access, it doesn't read the emails. If AT&T is hosting your email and also the OAuth service...they have access to your emails anyway.

 

[Chewy509]

This is only useful in the situation were you are using your ISP's email service.

Typically, the user account/password for both account administration and email are the same, ergo if someone has your password extracted from your email client, they could potentially login into the customer account portal and modify your account. For someone like AT&T or any other major telco, this could include purchasing new mobile phones, setting up new accounts, etc.

By enforcing different passwords for email and the user account (in the customer portal), means if the password used for email is acquired by 3rd parties, doesn't allow the person to access your overall account settings and do other things as well. (eg purchase new mobile phone) All that is lost, is access to the email component of the service.

 

[sechs]

Thunderbird does support OAuth, but I've only used it in connection with Gmail.

I wouldn't put it past AT&T to use something non-standard or out of date which isn't compatible, however.

 

[LunarMist]

Maybe ATT is off the Oath now? All these big telco shenanigans are why I mostly use the 3rd party emails.
It's just that there are too many old ATT and Verixons emails to find them all.

 

[sechs]

Why did you leave the messages on the telco servers?

I've always downloaded my messages, so Thunderbird now manages about two decades' worth in email.

 

[LunarMist]

Why did you leave the messages on the telco servers?

I've always downloaded my messages, so Thunderbird now manages about two decades' worth in email.

No, it's not that. I normally use the POP 3 to download and delete, except on all the cellphones. For many years I used Verizon and some ATT email addresses for various websites.

 

[sechs]

So, what's the problem with "too many old ATT and Verixons emails?"

 

[LunarMist]

Other than that I won't be able to retrieve any new emails on the ATT SBClobal account after they implement the OAuth?

 

[Chewy509]

%#%$#%$#%$#%$ just implement the Secure Email Key option and use your current email client as is... Nothing else changes. %$#%$^%$%^#$%^^ /rant over.

 

[sechs]

Other than that I won't be able to retrieve any new emails on the ATT SBClobal account after they implement the OAuth?

Stop using it.

Problem solved!

 

[LunarMist]

Yeah, that's the most likely outcome. I hope it doesn't become an industry standard in my lifetime.

 

[sechs]

I'm guessing that you're dead already, then.

You may want to check if Gmail will fetch the mail for you. I haven't set it to up with any other accounts since the days of POP, so I don't know what it supports now.

 

[LunarMist]

Do you mean that everyone will start using the OAuth soon? I don't use the GMail except to set up a cell phone.