OT: Google swines

[Tim Streater]

You may recall that Google was all in a lather last year that access by 3rd party apps to gmail had to be via OAUTH2 or by using app-specific passwords? I wasn't going to go to the bother of adding OAUTH2 support to my email client but discovered that by having them generate an app-specific password I could just use that in my client as the account password.

What the buggers didn't mention is that changing your general google password will invalidate your app-specific password. And they made it a lot harder to find the place to generate another one.

[SteveW]

Surely, you can Google it? ;)

[Theo]

That makes sense. If somebody's account is compromised, the first thing they should do is change their password. It follows that changing it also causes things authorised by that password to be revoked too. Otherwise the hacker who has your password could set up app passwords deep in the Google settings black hole and you'd be none the wiser that they still had access after you changed your master password.

I agree it would be good if it told you about app passwords after changing your master password, though.

Theo

[Brian Gaff]

Yes in order to get this outlook express to work, it needed a lot of messing about. I don't think its deliberate. it looks like somebody kind of vectored out from the old system to some new code which obeys some different logic to me. I do question whether in real terms such two factor authentication is doing anything other confusing the would be user. I've a similar issue with Dropbox if you log in forom unusual computers and they send a text of a number which you can only get at if you have the actual phone with you at the time. Bleedin obvious that one might be your home phone an d the other your work one. Brian