Support for OAuth2.0

Mar 21, 2022
Rosemary Lockie wrote
Hello,

Will VPO3 be including support for OAuth2 authentication in a future version please?

This will shortly become mandatory for using Gmail with POP3/SMTP.

I suspect also it is, or will become necessary for Hotmail/Outlook.com accounts too, so not just limited to Gmail

Kind Regards,
Rosemary Lockie
2 Answers
Mar 21, 2022
Paul Smith agent wrote
Hello, Rosemary

> Will VPO3 be including support for OAuth2 authentication in a future version please?
>
> This will shortly become mandatory for using Gmail with POP3/SMTP.
>
> I suspect also it is, or will become necessary for Hotmail/Outlook.com accounts too, so not just limited to Gmail

We are investigating it, but it is not currently a high priority, because Gmail, Hotmail, Outlook.com, etc are generally not the sort of email accounts that will be used with VPOP3, because they are all designed for individual users, rather than a whole business, so the requirement to work with these accounts is an edge-case.


A big problem is that OAuth2 is not designed for unattended access, so Oath2 access tokens typically have a limited lifespan. When that lifespan is up, then the user needs to reauthenticate with the server, and that is an interactive process, so VPOP3 would not be able to do it automatically. Essentially, at some point, VPOP3 would be unable to collect or send mail until an administrator logs into the server and reauthenticates. This could cause severe disruption for the business. The authentication process is also not designed to be done 'remotely'. Usually it will be done on the same computer or device that the email client is running on, which would be the VPOP3 computer itself in this case (not via the VPOP3 administration console). The authentication & reauthentication processes involve the user actually viewing (for example) Google's website, and entering their authentication details into a form there, as well as, possibly, using two-factor authentication on Google's website. This could not be automated.

Regards

Paul
Mar 21, 2022
Rosemary Lockie wrote
Paul,

Thank you very much for your detailed reply. I am disappointed, but unsurprised that support won't be included any time soon in VPOP3, but you have, at least, clearned up some of my current confusion over how OAuth2 actually works, in relation to a Desktop client, for which I'm grateful. I have been using VPOP3 to pick up from my GMail a/c using its "insecure" setting, but Google will be dropping support for that in May this year, so I am trying to get it to work with my eMail client (OAuth2 enabled) directly, but finding Google's interface to its setup somewhat obscure! :-)

Kind Regards,
Rosemary Lockie