Am 23.06.22 um 00:45 schrieb Andy Burnelli:
> Carlos E. R. wrote:
>
>>> Just as with Apple, the stated reason isn't ever the real reason; but I
>>> would be curious what Microsoft's _stated_ rationale is for _requiring_ a
>>> mothership tracking account just for us to use the operating system that we
>>> paid for that they own (we essentially rent a license to use it from them).
>>
>> What would be their reasons is irrelevant. If you do not want to comply,
>> switch to Linux.
>
> Again, as always, we're different.
> I ask questions such as why is the sky blue and you don't, apparently.

As economist I tell you that Carlos's answer is the only reasonable
answer and intelligent people do exactly that.

> I also want to know how gravity works instantly when it's not even a force,
> so I'm currently questioning why the metric tensor is used twice in the
> Einstein equations (once multiplied with the curvature scalar and once with
> the cosmological constant), but this newsgroup isn't likely the place to
> ask those kinds of questions.

Completely irrelevant in the context.

--
De gustibus non est disputandum

....winston wrote:

> The app password option, while not recommended by Google, appears to be
> available for the population that is not using OAuth2 capable email
> clients including those that have options to setup for OAuth2 when
> setting up automatically but still choose to manually set up(app
> password necessary since OAuth2 not a configurable option with Auto,
> SSL, TLS only available).

There's a huge difference between security & privacy in OAuth2 solutions.
OAuth2, unfortunately, has astoundingly huge unexpected privacy issues.

For those of us who don't have a Google Account on our phones (and, of
course, who don't want one created just to read our email with a MUA),
the "app passwords" option might be the least onerous available to Android
MUAs after Google deprecated traditional logins/passwords May 30th, 2022.

The intractable and yet non-intuitive problem (as I've personally
experienced using FairMail) with OAuth2 on Android is that the free MUA
developers probably can't afford to pay for the yearly $15K to $75K
security audit Google requires of them if they want to authorize AUth2 over
the web (as Thunderbird on Windows does).

Hence, on Android, most (if not all!) freeware MUAs will resort to
_creating_ a Google Account on the Android phone in order to authorize the
OAUth2 credentials for the first time (if the account isn't prior set up).

Which makes OAuth2 the worst solution possible in terms of privacy.

In the search for a better method, both Andy Burns & Frank Slootweg
independently suggested that Google hasn't yet deprecated "app passwords".

However, app passwords _requires_ permanent 2FA/2SV/MFA/MSV to be set up.
While that increases security, it vastly decreases privacy.

The reason 2FA/2SV/MFA/MSV destroys your privacy is that you need a "second
something", which is where the decision needs to be made what that will be.

The question to be answered is what is the least privacy-destroying second
something out there?

Andy Burns has suggested it "might" be Google Voice on an iPad.

I will explore that avenue since the iPad does NOT create a separate Google
Account when you log into a Google application (such as GMail or GV apps).

Before I go that route, does anyone here have a suggested for the least
privacy destroying second something for 2FA/2SV/MFA/MSV for app passwords?
--
Often on Usenet you can find kind-hearted purposefully helpful people who
know a lot more about what you're trying to do than you ever will know.

UPDATE

1. On May 30th, Google destroyed the login/password connection to
applications that didn't previously _create_ a Google Account
on the computer (e.g., K-9 Mail, Fair Mail, etc.)

2. Some developers, e.g., that of Fair Mail, unhappily quit and then
re-joined a few weeks later thoroughly humiliated but wanting to
keep their software alive, caved in to Google demands and forced
users to have a Google Mothership Tracking Account in order to
use their product. (They reluctantly did so as the only other
alternative was to cave in to Google's demands for 2FA/2SV privacy
holes.)

3. K-9, at first, also caved in to Google's unreasonable demands,
but then they teamed up with the Thunderbird folks, and with the
added resources, the most recent K-9 release, version 6.201,
now performs OAuth2 authorization _without_ creating a Google
Mothership tracking account on the Android phone!

Woo hoo!
Here are the related screenshots:
<https://i.postimg.cc/15XPh8nc/k9mail01.jpg> K-9 Mail with OAuth2 6.200
<https://i.postimg.cc/rpWC5zxw/k9mail02.jpg> GPS vs F-Droid K-9 update
<https://i.postimg.cc/Y2XDxnhG/k9mail03.jpg> K-9 Mail version 6.201
<https://i.postimg.cc/5NqnKf9t/k9mail04.jpg> OAuth2 finally uses the web
<https://i.postimg.cc/W4Knq385/k9mail05.jpg> NO Google Account on Android!
--
I'm going to guess that the Thunderbird team paid for the security audit
that the Fair Mail developer said was necessary to authorize OAUth2 over
the web.