Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I've just installed Calibre to manage my Kindle ebooks and it wants my Gmail username and password to be able to send documents to my @Kindle.com email address.

Which made me wonder. There is Google OAuth 2.0 for authentication, couldn't this app just use it and then call some API to send an email on my behalf without actually knowing my password?

I am very careful who I give my Gmail password to and some OSS application that I see for the first time does not make me very comfortable doing so.

share|improve this question
    
It seems that it should be possible to send emails from my Gmail account without actually providing a password to 3rd party: developers.google.com/google-apps/gmail/oauth_overview –  Borek May 11 '12 at 12:05

1 Answer 1

What I do in order to mitigate this (because I'd rather applications be written to use the standard protocols of IMAP and SMTP) is to use Google's two-factor authentication.

When you turn that on, it enables something they call "application specific passwords", which are limited in scope and can be revoked at any time. These application specific passwords are provided for IMAP and SMTP and other services that do not support the two-factor authentication system for whatever reason, or where the common case has no support for it (e.g., stock mail clients).

Since Calibre uses standard mail protocols to communicate, you'd have to use one of these types of passwords; OAuth isn't an option unless the application were re-written to use Google APIs (thereby being specific to a single vendor, which would of course be bad).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.