|
I've just installed Calibre to manage my Kindle ebooks and it wants my Gmail username and password to be able to send documents to my @Kindle.com email address. Which made me wonder. There is Google OAuth 2.0 for authentication, couldn't this app just use it and then call some API to send an email on my behalf without actually knowing my password? I am very careful who I give my Gmail password to and some OSS application that I see for the first time does not make me very comfortable doing so. |
|||
|
|
What I do in order to mitigate this (because I'd rather applications be written to use the standard protocols of IMAP and SMTP) is to use Google's two-factor authentication. When you turn that on, it enables something they call "application specific passwords", which are limited in scope and can be revoked at any time. These application specific passwords are provided for IMAP and SMTP and other services that do not support the two-factor authentication system for whatever reason, or where the common case has no support for it (e.g., stock mail clients). Since Calibre uses standard mail protocols to communicate, you'd have to use one of these types of passwords; OAuth isn't an option unless the application were re-written to use Google APIs (thereby being specific to a single vendor, which would of course be bad). |
|||
|
|
