Date: Thu, 15 Jul 2021 22:54:42 +0100 From: RW <rwmaillists@googlemail.com> To: freebsd-questions@freebsd.org Subject: Re: What the hell starts pulseaudio?! Message-ID: <20210715225442.3ccef0ae@gumby.homeunix.com> In-Reply-To: <cbbc2f051e7604453f7be671b55624e08da60353.camel@riseup.net> References: <5b18f5de-7aae-a226-88cd-a210507d5c5@gmail.com> <72194e9f-261c-c3da-996-f8e1bcad2164@gmail.com> <CAM8r67BZPJiWtxY75DRw9R1pZgOgE1PvYQ_g6_BgEtHmWCandg@mail.gmail.com> <acc7c26d-2186-4725-be62-7b1d5a9e25f@gmail.com> <CAM8r67CL_Q2se9Df_63N9x6X=YEkJzzqpMQyVObpQXPCzTt4Kg@mail.gmail.com> <f41a463d-46d9-903d-2a19-ef64a9636d7b@googlemail.com> <20210715063116.85e42de5c276f40c8920ee2c@sohara.org> <20210715105229.50fee7b3@archlinux> <23e852c3-b9f4-3e7a-777c-50ff3c222f16@gmail.com> <20210715112546.61525c25b44bb93c10b87f21@sohara.org> <5d8e1ddf-92d1-48a6-0b76-04e2a81077f7@kicp.uchicago.edu> <20210715163245.658c4b29@gumby.homeunix.com> <65457cf2-37d2-5050-fa59-8926ea240baa@kicp.uchicago.edu> <20210715182442.722507f6@archlinux> <CA%2ByoEx8HBKFuKR%2B8NetorFYN2aoun59N9Muzjh5aDNKwLWodxA@mail.gmail.com> <20210715211628.13cf80fb@gumby.homeunix.com> <20210715223007.3f8ed5db@archlinux> <cbbc2f051e7604453f7be671b55624e08da60353.camel@riseup.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 15 Jul 2021 22:45:47 +0200 Ralf Mardorf wrote: > On Thu, 2021-07-15 at 22:30 +0200, Ralf Mardorf wrote: > > On Thu, 15 Jul 2021 21:16:28 +0100, RW via freebsd-questions wrote: > > > On Thu, 12 Mar 2020 22:13:47 -0400, edwardp@gmx.com stated: > > > https://www.bleepingcomputer.com/news/security/google-to-force-oauth-in-g-suite-to-increase-security/ > > > > If this information is correct, it applies to G Suite accounts. > > > > It doesn't specifically mention individual Gmail accounts. > > Lets be honest here. It is no longer a question of "if" but rather > "when" will Google & Microsoft and then all of the other carriers > follow suit and limit access to their products only by apps employing > OAuth2 access. I'm not sure about gmail. When you enable 2FA it disables the use of the main password from mail clients, but you can still get an autogenerated random "app password" to use instead. App passwords can't be used for anything else but accessing mail servers and they can be made arbitrarily long. oauth2 looks to be only marginally more secure since its secret can be read by a cracker or malware just as easily as an app password can. Oauth2 protects against the case where an attacker has intercepted the connection and got around TLS, which seems the lesser case to me. I don't see any good reason for gmail to ban app passwords.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20210715225442.3ccef0ae>