Re: [gentoo-user] Seamonkey automatic email download after switch to Oauth2

[Michael]

On Friday, 3 June 2022 12:15:53 BST spareproject776 wrote:

> How did you even enable the oauth thing ? only had security device or
> push to an authenticated device available. Then lied and forced enabling
> sms as a 'recovery' option.

When I enabled OAuth2 it was early days and Google did not ask for 2FA as a 
prerequisite back then.  All you had to provide, for account recovery, was 
another email address.  So I set up a second Google email address for this 
purpose and cross referenced the two accounts.  Some months thereafter Google 
started asking for 2FA via SMS, before you could access the page to set up app 
access.  More recently they also started asking for DOB, "... for legal 
purposes".  Soon they will be asking for digital ID and a DNA test, or 
whatever.  :p

I noticed whenever I tried to login from a remote location Google would block 
the mail client and also block webmail login if I tried to use a browser.  
Evidently, geolocation/IP address was being used as a security check.  To 
acknowledge this was not an attempt by some remote and nefarious actor to 
compromise my account, I had to connect to Google by tunneling via a VPN 
connection to my home and from there to the Google webmail.  After that I was 
able to login remotely.

The question about privacy is a moot point.  Privacy is often conflated with 
identity and consequently with security.  All a mail service provider *need* 
to know is if the person trying to login is the same person who set up/owns 
the account.  A single or multiple challenge-response mechanism over an 
encrypted network connection is enough to identify the owner of the account 
via the credentials exchanged between client and server.  No sharing of any 
other private and personally identifiable information needs to be part of it.