Here is a discussion about that very question on the K-9 forum.
<https://forum.k9mail.app/t/oauth2-authentication/2671>
"Nowhere it says 'app password.' Thus, you can still use your Gmail
with apps through app passwords. You just cannot use you regular
password any more."

Of course, the very next post says that is wrong, and then the rest of the
discussion is bickering about what Google is doing given Google didn't say.

So, who knows.
Not me.

Do you?
--
The job of a Usenet post is to add useful value each time we communicate.

Andy Burnelli <spam@nospam.com> writes:

> Here is a discussion about that very question on the K-9 forum.
> <https://forum.k9mail.app/t/oauth2-authentication/2671>
> "Nowhere it says 'app password.' Thus, you can still use your Gmail
> with apps through app passwords. You just cannot use you regular
> password any more."
>
> Of course, the very next post says that is wrong, and then the rest of the
> discussion is bickering about what Google is doing given Google didn't say.
>
> So, who knows.
> Not me.
>
> Do you?

Google says you can use app passwords here.

https://support.google.com/accounts/answer/6010255

(I didn't get the email but I guess the coloured part is the content of
the email).

The question is will K9 Mail work with Google after May 30th
if you don't want 2FA?

I'm not quite sure, but apparently today there are these potential options:
a. OATH2 (but K-9 doesn't support it)
b. login/password (but it will be going away on May 30th)
c. App specific passwords (will Google take these away also?)
d. 2FA (that's out of the question for this thread)

Here is the official Google announcement (afaik).
<https://support.google.com/accounts/answer/6010255>

"An App password is a 16-digit passcode that gives a non-Google app
or device permission to access your Google Account."

And here is Google help on "signing in with app passwords".
<https://support.google.com/accounts/answer/185833>

Richmond wrote:

> Google says you can use app passwords here.
> https://support.google.com/accounts/answer/6010255

That references this
*Create & use App Passwords*
<https://support.google.com/accounts/answer/185833>

Now the question boils down to two questions:
a. Does K-9 Mail support this (new to me) concept of "app passwords"?
b. Does this (new to me) "app password" process work without the horrid 2FA?

Create & use App Passwords

If you use 2-Step-Verification and get a "password incorrect" error when you
sign in, you can try to use an App Password.

Go to your Google Account.
Select Security.
Under "Signing in to Google," select App Passwords. You may need to sign in.
If you don't have this option, it might be because:
2-Step Verification is not set up for your account.
2-Step Verification is only set up for security keys.
Your account is through work, school, or other organization.
You turned on Advanced Protection.

At the bottom, choose Select app and choose the app you using and then
Select device and choose the device you're using and then Generate.
Follow the instructions to enter the App Password. The App Password is the
16-character code in the yellow bar on your device.
Tap Done.
Tip: Most of the time, you'll only have to enter an App Password once per
app or device, so don't worry about memorizing it.

> (I didn't get the email but I guess the coloured part is the content of
> the email).

I got the mail out of the blue because I use K9 mail on Android.
<https://i.postimg.cc/MGfN2Z7r/gmailpasswd01.jpg>
<https://i.postimg.cc/2yBvxJhJ/gmailpasswd02.jpg>
<https://i.postimg.cc/432zCNgx/gmailpasswd03.jpg>
<https://i.postimg.cc/MGs3HSyn/gmailpasswd04.jpg>
<https://i.postimg.cc/cL9r9qFW/gmailpasswd05.jpg>
<https://i.postimg.cc/RhHkj4gJ/gmailpasswd06.jpg>

The questions for Android users on K9 mail who don't want 2FA are:
a. Does K-9 Mail support "app passwords"?
b. Do "app passwords" work without the hated 2FA?

Andy Burnelli wrote:

> That references this *Create & use App Passwords*
> <https://support.google.com/accounts/answer/185833>
>
> Now the question boils down to two questions:
> a. Does K-9 Mail support this (new to me) concept of "app passwords"?

K-9 doesn't know or care, google generates a unique password which you use only
within a specific app (such as POP/IMAP client) the app just thinks it's logging
on as normal, I don't know if you use your normal google username, or if it
generates a unique username too?

> b. Does this (new to me) "app password" process work without the horrid 2FA?

You have to have 2FA enabled on your google account before you can create the
password.

Andy Burns <usenet@andyburns.uk> wrote:
> Andy Burnelli wrote:
>
> > That references this *Create & use App Passwords*
> > <https://support.google.com/accounts/answer/185833>
> >
> > Now the question boils down to two questions:
> > a. Does K-9 Mail support this (new to me) concept of "app passwords"?
>
> K-9 doesn't know or care, google generates a unique password which you
> use only within a specific app (such as POP/IMAP client) the app just
> thinks it's logging on as normal, I don't know if you use your normal
> google username, or if it generates a unique username too?

It uses your normal Google Account name, i.e. normally
<someone>@gmail.com.

> > b. Does this (new to me) "app password" process work without the
> > horrid 2FA?
>
> You have to have 2FA enabled on your google account before you can
> create the password.

It used to be that you could switch off 2-Step Verification (it isn't
2FA) after creating the App Password(s), but since at least December 18,
2020, that's sadly no longer the case, 2-Step Verification must stay
on, otherwise the App Passwords will be deleted from your Google
Account.

Frank Slootweg wrote:

> It used to be that you could switch off 2-Step Verification (it isn't
> 2FA)

2-step, 2-factor? something you know plus something you hold, seems a very
slight distinction in name.

> after creating the App Password(s), but since at least December 18,
> 2020, that's sadly no longer the case, 2-Step Verification must stay
> on, otherwise the App Passwords will be deleted from your Google
> Account.

Andy Burns <usenet@andyburns.uk> wrote:
> Frank Slootweg wrote:
>
> > It used to be that you could switch off 2-Step Verification (it isn't
> > 2FA)
>
> 2-step, 2-factor? something you know plus something you hold, seems a very
> slight distinction in name.

In some of the 2-Step Verification scenarios, there's no "something
you have". For example when the second step involves a code sent by SMS,
that's something you *get*, not something you *have*.

If you want to know more about the indeed subtle differences between
2-Step Verification (c.q. 2-Step Authentication) and 2-Factor
Authentication, then see the Wikipedia page on 'Multi-factor
authentication' and search the page on the word 'step'.

''Multi-factor authentication'
<https://en.wikipedia.org/wiki/Multi-factor_authentication>
>
> > after creating the App Password(s), but since at least December 18,
> > 2020, that's sadly no longer the case, 2-Step Verification must stay
> > on, otherwise the App Passwords will be deleted from your Google
> > Account.

Frank Slootweg wrote:

> Andy Burns <usenet@andyburns.uk> wrote:
>
>> something you know plus something you hold
>
> In some of the 2-Step Verification scenarios, there's no "something
> you have". For example when the second step involves a code sent by SMS,
> that's something you *get*, not something you *have*.

The phone they're sent to (or the SIM) is the something you hold.

Andy Burns wrote:

>> b. Does this (new to me) "app password" process work without the horrid 2FA?
>
> You have to have 2FA enabled on your google account before you can create the
> password.

Ug.

Well that's that.
a. If K9 mail updates to OAuth2 by May 30th, I can still use it on Android.
b. If not, then I'll start searching for another GMail MUA replacement.

Thanks for helping me sort this out as I was ignorant of all of this, where
I especially enjoyed learning from your tested link to that video by the
author of OAuth1 who condemned what has become of OAuth2 before he divested
himself of it.

BTW. I'm always impressed at how much more you inherently know than I do.
Are you in the Android "field" in some manner?
--
Usenet isn't for amusement; it's for learning from and teaching each other.

Andy Burns <usenet@andyburns.uk> wrote:
> Frank Slootweg wrote:
>
> > Andy Burns <usenet@andyburns.uk> wrote:
> >
> >> something you know plus something you hold
> >
> > In some of the 2-Step Verification scenarios, there's no "something
> > you have". For example when the second step involves a code sent by SMS,
> > that's something you *get*, not something you *have*.
>
> The phone they're sent to (or the SIM) is the something you hold.

Well, the - snipped - reference says differently. So I suggest you
read what they say about 'Possession' and 'two-step authentication'.

Also the SMS scenario is another broad area, because SMS is just an
*example* of a one-time passcode, there are differences between 'dumb'/
'feature' phones and smartphones, the receiving end might not be a
mobile phone, the phone might or might not be something only you hold,
etc..

See for example how Wikipedia's two-step authentication scenario is
quite different from Google's 2-Step Verification SMS scenario.

Bottom line: In some scenarios Google's 2-Step Verification *is*
2FA (2-Factor Authentication), in other scenarios, it's not. That's why
*Google* - correctly - calls it '2-Step Verification', because, in *all*
scenarios it involves two *steps*.

In article <j8ke2tF8r9qU3@mid.individual.net>, Andy Burns
<usenet@andyburns.uk> wrote:

> >> something you know plus something you hold
> >
> > In some of the 2-Step Verification scenarios, there's no "something
> > you have". For example when the second step involves a code sent by SMS,
> > that's something you *get*, not something you *have*.
>
> The phone they're sent to (or the SIM) is the something you hold.

except that the code is sent over an insecure and easily intercepted
channel. you do not 'have' it.

that is very different than something you *have*, usually a totp app
that generates the code locally (in sync with the server) and never
sent.

Update: (For the permanent Usenet record so all benefit from every action)

K-9 Mail, as of this week's version 6.201, allows OAuth2 to authenticate
via the web (just like PC Thunderbird does), without creating a mothership
tracking account on Android!

<https://groups.google.com/g/comp.mobile.android/c/kDealNRVzD0/m/g8MgPeXKBAAJ>