This is all in preparation for googles coming change requiring better
security for gmail logins.

I generated a "mail" app password for my "Galaxy S9" using the "other"
option for the device selection. That is the name shown under "Your
Google prompt devices" on the 2 step verification page.

I entered the 16 letter app password into K-9 on my phone. This results
in the message "Setup could not finish Username or password
incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
Username and password not accepted)"

I tried it with Security "None", "STARTTLS" and "SSL/TLS"

Can anyone suggest what I am doing wrong?

On 2022-03-11 20:51, Bob F wrote:
> This is all in preparation for googles coming change requiring better
> security for gmail logins.
>
> I generated a "mail" app password for my "Galaxy S9" using the "other"
> option for the device selection. That is the name shown under "Your
> Google prompt devices" on the 2 step verification page.
>
> I entered the 16 letter app password into K-9 on my phone. This results
> in the message "Setup could not finish    Username or password
> incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
> Username and password not accepted)"
>
> I tried it with Security "None", "STARTTLS" and "SSL/TLS"
>
> Can anyone suggest what I am doing wrong?

Have not tried k-9. I use imap and ssl, same as before; just a different
password, 16 char long.

--
Cheers, Carlos.

Carlos E.R. wrote:

> Have not tried k-9. I use imap and ssl, same as before; just a different
> password, 16 char long.

I just want to voice my +1 support for the OP as I would _love_ for the OP
with the help from kind-hearted purposefully helpful people here, to solve
this conundrum.

Normally I test everything stated in the newsgroup, but I'm not going to set
up 2FA/2SV unless a gun is pointed at my head, but I don't disparage others
who do.

I'll be watching for a summary of results so that all of us benefit.

On 3/11/2022 9:49 PM, Ralph Fox wrote:
> On Fri, 11 Mar 2022 11:51:08 -0800, Bob F wrote:
>
>> This is all in preparation for googles coming change requiring better
>> security for gmail logins.
>>
>> I generated a "mail" app password for my "Galaxy S9" using the "other"
>> option for the device selection. That is the name shown under "Your
>> Google prompt devices" on the 2 step verification page.
>>
>> I entered the 16 letter app password into K-9 on my phone. This results
>> in the message "Setup could not finish Username or password
>> incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
>> Username and password not accepted)"
>>
>> I tried it with Security "None", "STARTTLS" and "SSL/TLS"
>>
>> Can anyone suggest what I am doing wrong?
>
>
> 1. Note whether K-9 is configured to use IMAP or POP3 to fetch your
> mail.
>
> Log on to the Gmail web interface and go to
> ⚙ (Settings) >> See All Settings >> Forwarding and POP/IMAP
>
> If K-9 is using POP3 to fetch your mail, ensure that POP download
> is enabled on the "Forwarding and POP/IMAP" page.
>
> If K-9 is using IMAP to fetch your mail, ensure that IMAP access
> is enabled on the "Forwarding and POP/IMAP" page.

Always been POP3. Just trying to update for the change

>
>
> 2. If your app password still doesn't work after doing #1 above,
> then see the information on this help page:
> <https://support.google.com/mail/answer/7126229>.
>
> Expand "I can't sign in to my email client" and follow *all* the
> steps under it, especially including the "DisplayUnlockCaptcha"
> step.

I will follow through on that tomorrow.

>
>
> 3. When you wrote "I entered the 16 letter app password into K-9 on
> my phone", I presume you have both:
> i) Your full Gmail email address in the 'Username' field
> ii) The 16 letter app password in the 'Password' field.

Yep! same as before with new password.

>
> AFAIK Gmail will not accept access with Security "None".
> Use "SSL/TLS (always)" or "STARTTLS (always)".

Always been "none" and working fine up to now. I did try all 3 in this
case as described.

Thanks for the response and idea for tomorrow's next try.

On 3/11/2022 10:20 PM, Bob F wrote:
> On 3/11/2022 9:49 PM, Ralph Fox wrote:
>> On Fri, 11 Mar 2022 11:51:08 -0800, Bob F wrote:
>>
>>> This is all in preparation for googles coming change requiring better
>>> security for gmail logins.
>>>
>>> I generated a "mail" app password for my "Galaxy S9" using the "other"
>>> option for the device selection. That is the name shown under "Your
>>> Google prompt devices" on the 2 step verification page.
>>>
>>> I entered the 16 letter app password into K-9 on my phone. This results
>>> in the message "Setup could not finish    Username or password
>>> incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
>>> Username and password not accepted)"
>>>
>>> I tried it with Security "None", "STARTTLS" and "SSL/TLS"
>>>
>>> Can anyone suggest what I am doing wrong?
>>
>>
>>   1.  Note whether K-9 is configured to use IMAP or POP3 to fetch your
>>       mail.
>>
>>       Log on to the Gmail web interface and go to
>>       ⚙ (Settings) >> See All Settings >> Forwarding and POP/IMAP
>>
>>       If K-9 is using POP3 to fetch your mail, ensure that POP download
>>       is enabled on the "Forwarding and POP/IMAP" page.
>>
>>       If K-9 is using IMAP to fetch your mail, ensure that IMAP access
>>       is enabled on the "Forwarding and POP/IMAP" page.
>
> Always been POP3. Just trying to update for the change
>
>>
>>
>>   2.  If your app password still doesn't work after doing #1 above,
>>       then see the information on this help page:
>>       <https://support.google.com/mail/answer/7126229>.
>>
>>       Expand "I can't sign in to my email client" and follow *all* the
>>       steps under it, especially including the "DisplayUnlockCaptcha"
>>       step.
>
> I will follow through on that tomorrow.

No significant info there, and it refers only to IMAP, not POP3.

I have found no information concerning the detailed setting needed for
K-9, or how the name I give to a "app password" device relates and is
connected to my app in my device by the gmail servers.

>
>>
>>
>>   3.  When you wrote "I entered the 16 letter app password into K-9 on
>>       my phone", I presume you have both:
>>         i)  Your full Gmail email address in the 'Username' field
>>        ii)  The 16 letter app password in the 'Password' field.
>
> Yep! same as before with new password.
>
>>
>>       AFAIK Gmail will not accept access with Security "None".
>>       Use "SSL/TLS (always)" or "STARTTLS (always)".
>
> Always been "none" and working fine up to now. I did try all 3 in this
> case as described.
>
> Thanks for the response and idea for tomorrow's next try.
>

Bob F wrote:

> No significant info there, and it refers only to IMAP, not POP3.
>
> I have found no information concerning the detailed setting needed for K-9, or
> how the name I give to a "app password" device relates and is connected to my
> app in my device by the gmail servers.

I just created an app password for my gmail account
added a new account to k-9
gave it my gmail address and the app password
clicked manual (to ensure I was using POP rather than allow it any choice of IMAP)

I had to change the hostname from pop3.gmail.com to pop.gmail.com
left security on SSL/TLS
left password on "normal"
left port on 995

it just worked ...

Bob F <bobnospam@gmail.com> wrote:
> This is all in preparation for googles coming change requiring better
> security for gmail logins.
>
> I generated a "mail" app password for my "Galaxy S9" using the "other"
> option for the device selection. That is the name shown under "Your
> Google prompt devices" on the 2 step verification page.
>
> I entered the 16 letter app password into K-9 on my phone. This results
> in the message "Setup could not finish Username or password
> incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
> Username and password not accepted)"
>
> I tried it with Security "None", "STARTTLS" and "SSL/TLS"
>
> Can anyone suggest what I am doing wrong?

As Andy Burns mentioned, SSL/TLS should be OK. I don't use K-9, but I
use Google App Passwords with the Thunderbird email program on Windows
and that works with 'Connection security: SSL/TLS' and 'Authentcation
method: Normal password'.

Another point: Did you by any chance disable 2-Step Verification in
your Google Account *after* generating the App Password? If so, that's
at least one possible cause, because App Passwords get disabled/deleted/
<whatever> if you turn off 2-Step Verification.

Andy Burns wrote:

> it just worked ...

Hi Andy,
I want to continue to use K9 if I can after May 30th, but I don't want to
set up a 2FA/2SV (for reasons I'm sure you're well aware of).

When I saw your step-by-step post, I was happy to see that finally there's a
sequence I can follow, but you didn't mention a thing about 2SV/2FA.

Can you confirm whether or not I would need to set up (at least once) that?

Andy Burnelli wrote:

> I want to continue to use K9 if I can after May 30th, but I don't want to
> set up a 2FA/2SV (for reasons I'm sure you're well aware of).
>
> When I saw your step-by-step post, I was happy to see that finally there's a
> sequence I can follow, but you didn't mention a thing about 2SV/2FA.

can't you use some semi-burner phone for 2SV?

> Can you confirm whether or not I would need to set up (at least once) that?

I already had 2SV enabled on the account, you can't create the app password
without it.

Andy Burns wrote:

> can't you use some semi-burner phone for 2SV?

I don't have a real "burner" phone but I have plenty of second line apps.
I use those second-line numbers when outfits force me to give them one.

If Google will accept a "second line" app phone number, that would work.
But usually Google is too smart to fall for those easy tricks.

Of course I can use another person's phone (like my wife or kids) but why
would I force on them something I myself would never want anyone to do?
>> Can you confirm whether or not I would need to set up (at least once) that?
>
> I already had 2SV enabled on the account, you can't create the app password
> without it.

Thanks.

What needs to be tested is whether any of the second-line apps will work for
Google's 2FA as then you can let the phone number expire and Google won't
even know that the second line went defunct (perhaps).

It's a worthwhile experiment anyway so if anyone does it, let us know.
Around May 30th, I may even try it myself with K9 mail if I must.

Andy Burnelli wrote:

> I don't have a real "burner" phone but I have plenty of second line apps.
> I use those second-line numbers when outfits force me to give them one.
>
> If Google will accept a "second line" app phone number, that would work.

They don't identify the 2SV device(s) by phone number, just by it/them being
signed-in to your google account.

Andy Burns <usenet@andyburns.uk> wrote:
> Andy Burnelli wrote:
>
> > I want to continue to use K9 if I can after May 30th, but I don't want to
> > set up a 2FA/2SV (for reasons I'm sure you're well aware of).
> >
> > When I saw your step-by-step post, I was happy to see that finally there's a
> > sequence I can follow, but you didn't mention a thing about 2SV/2FA.
>
> can't you use some semi-burner phone for 2SV?

Or, as I mentioned before, use backup codes:

'Sign in with backup codes'
<https://support.google.com/accounts/answer/1187538?hl=en>

Or use an (TOTP) authenticator app. I've no experience with this [1],
but as I understand it, an (TOTP) authenticator app/program does not
communicate with any 'mothership' - Google or other - but just generates
the needed one-time password and can be totally Google-free if so
desired. If needed, I'm sure others can help_with/comment_on that.

> > Can you confirm whether or not I would need to set up (at least once) that?
>
> I already had 2SV enabled on the account, you can't create the app password
> without it.

And you have to leave 2SV on, in order to be able to use App Passwords,
otherwise they will be disabled/deleted/<whatever>

[1] In some scenarios where security is critical, I do use *hardware*
token/OTP generators.

Andy Burns wrote:

>> I don't have a real "burner" phone but I have plenty of second line apps.
>> I use those second-line numbers when outfits force me to give them one.
>>
>> If Google will accept a "second line" app phone number, that would work.
>
> They don't identify the 2SV device(s) by phone number, just by it/them being
> signed-in to your google account.

Hi Andy,
I admit openly that I have no idea what that sentence is trying to tell me.

Probably because I've never used 2SF/2FA so I'm wholly unfamiliar how a
simple fake (aka 2nd-line) phone number can be "signed in" to anything.

When I use the 2nd-line fake numbers to create an account on a social
networking site, what happens (if they work) is the following:
1. I install & create an account on the fake 2nd line apps on my phone
2. That gives me a set of fake phone numbers (which are on my real phone)
3. I add a variety of fake 2nd-line apps because not all are accepted

Then, to register as a new user on a social-networking or support site...
A. I create an account and I do not give them an email address
B. They ask for a valid mobile number for them to send a verification text
C. I give it that fake (2nd-line) phone number & hold my breath for a minute

If that fake (2nd-line) phone number was acceptable to the web site, then
a. I receive the "validation code" on my phone in the 2nd-line app
b. I type that validation code into the last vestiges of the web site signup
c. When that works, I immediately delete that 2nd-line app from my phone

Knowing that is my only experience with such things, do you think that one
of the fake second-line phone numbers (which, I admit, trace back to my
phone, at least at the one time that they were used before being deleted),
will work with the Google 2SV/2FA required to get K9 mail to work after May
30th?

Andy Burnelli wrote:

> Andy Burns wrote:
>
>>> I don't have a real "burner" phone but I have plenty of second line apps.
>>> I use those second-line numbers when outfits force me to give them one.
>>>
>>> If Google will accept a "second line" app phone number, that would work.
>>
>> They don't identify the 2SV device(s) by phone number, just by it/them being
>> signed-in to your google account.
>
> Hi Andy,
> I admit openly that I have no idea what that sentence is trying to tell me.

Just that your "second lines" won't help, because it isn't even your "first
line" they use to identify the 2SV device.

> Probably because I've never used 2SF/2FA so I'm wholly unfamiliar how a
> simple fake (aka 2nd-line) phone number can be "signed in" to anything.

You would add a google account to the device under settings/accounts.

> When I use the 2nd-line fake numbers to create an account on a social
> networking site, what happens (if they work) is the following:
> 1. I install & create an account on the fake 2nd line apps on my phone
> 2. That gives me a set of fake phone numbers (which are on my real phone)
> 3. I add a variety of fake 2nd-line apps because not all are accepted

but google don't verify by phone call/text message (they can use a phone number
in an emergency lost phone situation to recover your account.)

Andy Burns wrote:

>> Probably because I've never used 2SF/2FA so I'm wholly unfamiliar how a
>> simple fake (aka 2nd-line) phone number can be "signed in" to anything.
>
> You would add a google account to the device under settings/accounts.

Oh. Associating a Google Account on the phone is the kiss of death.
You know why so I won't explain further.

Thanks for clarifying they don't use the phone number, but the Google
Account (which is the kiss of death).

They don't do that today.
But they will after May 30th.

Is the option someone brought up about getting a list of tokens viable?

Andy Burnelli <spam@nospam.com> writes:

> Andy Burns wrote:
>
>>> Probably because I've never used 2SF/2FA so I'm wholly unfamiliar how a
>>> simple fake (aka 2nd-line) phone number can be "signed in" to anything.
>> You would add a google account to the device under
>> settings/accounts.
>
> Oh. Associating a Google Account on the phone is the kiss of
> death. You know why so I won't explain further.
>
> Thanks for clarifying they don't use the phone number, but the Google
> Account (which is the kiss of death).
>
> They don't do that today.
> But they will after May 30th.
>
> Is the option someone brought up about getting a list of tokens viable?

I think they only send push notifications if you are signed into a
google app. Otherwise you can use Google Authenticator, or SMS messages.

https://support.google.com/accounts/answer/185839

Richmond wrote:

> I think they only send push notifications if you are signed into a
> google app. Otherwise you can use Google Authenticator, or SMS messages.
>
> https://support.google.com/accounts/answer/185839

That link was interesting as apparently Google equates 2SV with 2FA:
<https://support.google.com/accounts/answer/185839>
"With 2-Step Verification (also known as two-factor authentication),
you add an extra layer of security to your account in case your
password is stolen. After you set up 2-Step Verification,
you'll sign in to your account in two steps using:
1. Something you know, like your password
2. Something you have, like your phone"

While some said 2SV is different from 2FA, Google apparently doesn't agree.

On 3/13/2022 11:05 AM, Ralph Fox wrote:
> On Sun, 13 Mar 2022 10:24:51 -0700, Bob F wrote:
>> On 3/11/2022 10:20 PM, Bob F wrote:
>>> On 3/11/2022 9:49 PM, Ralph Fox wrote:
>>>>
>>>>   2.  If your app password still doesn't work after doing #1 above,
>>>>       then see the information on this help page:
>>>>       <https://support.google.com/mail/answer/7126229>.
>>>>
>>>>       Expand "I can't sign in to my email client" and follow *all* the
>>>>       steps under it, especially including the "DisplayUnlockCaptcha"
>>>>       step.
>>>
>>> I will follow through on that tomorrow.
>>
>> No significant info there,
>
>
> Did you expand "I can't sign in to my email client" and follow this
> step under "I can't sign in to my email client" ?
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> * If the tips above didn't help, visit https://www.google.com/accounts/DisplayUnlockCaptcha and
> follow the steps on the page.

I follow the steps. But there is no option for "android phone", just
"iphone", so I use "other" and call my phone "Galaxy S9", which is how
an earlier step described it. Why the hell doesn't it offer me a
"android phone" option?

I suspect the problem may be related to that. How does it really know
the exact device I am trying to get an "app password" for?

I have tried over a half dozen times so far, and can't get the password
accepted.

>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> In my experience that bullet point is significant.
>
> FYI twice (only) in the last 6 years my "App Password" has stopped being accepted.
> The fix both times was to to that.
>
>

On 3/13/2022 1:10 PM, Frank Slootweg wrote:
> Bob F <bobnospam@gmail.com> wrote:
>> This is all in preparation for googles coming change requiring better
>> security for gmail logins.
>>
>> I generated a "mail" app password for my "Galaxy S9" using the "other"
>> option for the device selection. That is the name shown under "Your
>> Google prompt devices" on the 2 step verification page.
>>
>> I entered the 16 letter app password into K-9 on my phone. This results
>> in the message "Setup could not finish Username or password
>> incorrect. (pop3 SASL auth PLAIN authentication failed. -ERR[AUTH]
>> Username and password not accepted)"
>>
>> I tried it with Security "None", "STARTTLS" and "SSL/TLS"
>>
>> Can anyone suggest what I am doing wrong?
>
> As Andy Burns mentioned, SSL/TLS should be OK. I don't use K-9, but I
> use Google App Passwords with the Thunderbird email program on Windows
> and that works with 'Connection security: SSL/TLS' and 'Authentcation
> method: Normal password'.
>
> Another point: Did you by any chance disable 2-Step Verification in
> your Google Account *after* generating the App Password? If so, that's
> at least one possible cause, because App Passwords get disabled/deleted/
> <whatever> if you turn off 2-Step Verification.

I only disabled it after complete failure to get it working.

Ralph Fox wrote:

> FWIW I turned off 2-Step Verification after generating and testing
> an app password, and the app password still works.

FWIW, I also turned off 2SV after testing with K-9 mail using an app password,
and K-9 *definitely* stopped working.

On 3/15/2022 11:50 PM, Ralph Fox wrote:

> FWIW I turned off 2-Step Verification after generating and testing
> an app password, and the app password still works.

Be careful folks.
This Ralph Fox is a troll.
It's ostracized in many newsgroups.

Andy Burns <usenet@andyburns.uk> wrote:
> Ralph Fox wrote:
>
> > FWIW I turned off 2-Step Verification after generating and testing
> > an app password, and the app password still works.
>
> FWIW, I also turned off 2SV after testing with K-9 mail using an app
> password, and K-9 *definitely* stopped working.

Ralph's experience is probably quite some time ago.

When I first set up my app passwords, I could also turn off 2SV after
creating them, but later (18DEC2020) when I had to redo some app
password, I could no longer turn off 2SV without losing the app
password. So that latter scenario matches your recent findings.

Anyway, your and my findings match what Google says:

'Sign in with App Passwords'
<https://support.google.com/accounts/answer/185833>
....
"App Passwords can only be used with accounts that have 2-Step
Verification turned on."