Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just installed Calibre to manage my Kindle ebooks and it wants my Gmail username and password to be able to send documents to my @Kindle.com email address.

Which made me wonder. There is Google OAuth 2.0 for authentication, couldn't this app just use it and then call some API to send an email on my behalf without actually knowing my password?

I am very careful who I give my Gmail password to and some OSS application that I see for the first time does not make me very comfortable doing so.

share|improve this question

closed as off-topic by Rubén, Al E., Sathya Jul 25 '15 at 15:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "It is a question about creating/developing a web application." – Rubén, Al E., Sathya
If this question can be reworded to fit the rules in the help center, please edit the question.

It seems that it should be possible to send emails from my Gmail account without actually providing a password to 3rd party: developers.google.com/google-apps/gmail/oauth_overview – Borek May 11 '12 at 12:05

What I do in order to mitigate this (because I'd rather applications be written to use the standard protocols of IMAP and SMTP) is to use Google's two-factor authentication.

When you turn that on, it enables something they call "application specific passwords", which are limited in scope and can be revoked at any time. These application specific passwords are provided for IMAP and SMTP and other services that do not support the two-factor authentication system for whatever reason, or where the common case has no support for it (e.g., stock mail clients).

Since Calibre uses standard mail protocols to communicate, you'd have to use one of these types of passwords; OAuth isn't an option unless the application were re-written to use Google APIs (thereby being specific to a single vendor, which would of course be bad).

share|improve this answer

There is a Google Gmail API. It can both read and sent emails. It uses Oauth to authenticate. Google doesn't want you sharing credentials. Here is the site for it: https://developers.google.com/gmail/api/

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.