Google & insecure apps

[Chris Newman]

Hi,

There is a thread on the ROOL forum regarding Google withdrawing "Less
secure app" access. No firm conclusion seems to have been reached.

In days of yore when Gmail was simple I got several accounts for
different purposes.

I use Hermes within Netfetch to bring mail to my computer(s).

As I understand the Google help sheet, if I can find my app in their list
(Hermes???), I can get a code to use instead of my current login in
password but I need 2-factor authentication to do that so presumably I
have to have my phone on but still go on line to enter the code.

Have I got this right?

Is Hermes likely to be updated in the near future so Google will be happy
with it? I haven't seen any traffic on the Hermes mail list for ages.

What alternatives are there?

I have a Yahoo account on which I got their one time password when they
had a spat about insecure devices. That works OK without any other
safeguards/identification. I wonder how long that will last.

My Hotmail account also still with a POP3 account and a Live.com server
setting (fingers crossed) but the mem sahib has Outlook 2010 as part of
Office and Hotmail have stopped that as it's insecure. Now she's waiting
for her Gmail accounts to stop working.

My John Lewis (was Waitrose) account hosted by PlusNet has no problems

So what alternatives are there? Get our own domain? That would be a bit
of a learning curve.

What other alternatives are there?

I can't be the only one in the same boat.

--
Chris Newman

[Chris Hughes]

In message <59db47a2...@waitrose.com>

Chris Newman <cvj...@waitrose.com> wrote:

> Hi,

> There is a thread on the ROOL forum regarding Google withdrawing "Less
> secure app" access. No firm conclusion seems to have been reached.

I thought Doug Webb had already given a suitable answer.

If you have a GMail account you would have received an email from them
about the change.

> In days of yore when Gmail was simple I got several accounts for
> different purposes.

> I use Hermes within Netfetch to bring mail to my computer(s).

> As I understand the Google help sheet, if I can find my app in their list
> (Hermes???), I can get a code to use instead of my current login in
> password but I need 2-factor authentication to do that so presumably I
> have to have my phone on but still go on line to enter the code.

Hermes/NetFetch would be considered an insecure application.

> Have I got this right?

Gmail (Google) want you to really use Webmail, as that way they have more
control over you....

> Is Hermes likely to be updated in the near future so Google will be happy
> with it? I haven't seen any traffic on the Hermes mail list for ages.

I spoke awhile ago when I got my email notice about this change with
Andrew @R-Comp and he said he was aware of the change and they were
looking into it. This probably means implementing OAuth/OAuth2 into
Hermes, as these 'protocols' are the claimed more secure way to access
Gmail and some other services. They are also looking at seeing what can
be done with IMAP access.

I see Alan Wrigley has a short while ago also posted on the AW mailing
list confirming they are monitoring the situation.

> What alternatives are there?

For RISC OS probably having to use !Iris, if the application password
workaround does not work. Until changes can be made to Hermes.

> I have a Yahoo account on which I got their one time password when they
> had a spat about insecure devices. That works OK without any other
> safeguards/identification. I wonder how long that will last.

Sounds like they are using an application password.

> My Hotmail account also still with a POP3 account and a Live.com server
> setting (fingers crossed) but the mem sahib has Outlook 2010 as part of
> Office and Hotmail have stopped that as it's insecure. Now she's waiting
> for her Gmail accounts to stop working.

Outlook 2010 will also fail with the Gmail change, its mentions it
somewhere in the gmail support notes. Newer versions of Outlook like 2019
do work with the new OAuth/OAuth2 protocol apparently. As does the current
version of Thurderbird email client I am told.

iPad/iPhone will already work with the more secure protocols already for
gmail

> My John Lewis (was Waitrose) account hosted by PlusNet has no problems

They are not affected by the Gmail changes.

> So what alternatives are there? Get our own domain? That would be a bit
> of a learning curve.

I have two personal domains and of course the WROCC one I use. I use
20i.com for my personal domains now.

> What other alternatives are there?

> I can't be the only one in the same boat.



--

Chris Hughes
Don't miss this years Wakefield Show 21st May 2022 - we have moved to
Cedar Court Hotel, Bradford
Check the latest information at www.wakefieldshow.org.uk

[Chris Newman]

In article <5ffe8fdb...@mytarbis.plus.com>,

Chris Hughes <new...@noonehere.co.uk> wrote:
> In message <59db47a2...@waitrose.com>
> Chris Newman <cvj...@waitrose.com> wrote:

> > Hi,

> > There is a thread on the ROOL forum regarding Google withdrawing "Less
> > secure app" access. No firm conclusion seems to have been reached.

<Big snip>

> I have two personal domains and of course the WROCC one I use. I use
> 20i.com for my personal domains now.

Thanks for the input Chris.

Next question. Which are the best domain companies to start looking at?

--
Chris Newman

[Dave]

In article <59dbaed9...@waitrose.com>,

In the past I had my/our domains hosted in different places, but a couple
of years ago, due to problems with those hosting companies I moved the two
remaining ones to Orpheus Internet.

Richard Brown is nice chap and also very helpful, and of course he does
know about RISC OS.

The two main domains, at slightly different times transferred easily, and
Richard has also set up other domains for us since.

Dave

--

Dave Triffid

[Chris Hughes]

In message <59dbaed9...@waitrose.com>

My suggestions is go for somewhere who can help you, especially if you
just want email hosting.

Orpheus Internet is an obvious one here, but I do suggest speaking to
Richard Brown - They will be at the Wakefield Show in May

XenCentric Hosting (formerly known as Purley Hosting and Spellings) run by
Neil Spellings - so knows about RISC OS as well.

Those would be my initial suggestions, you can always migrate them to
another hosting provider later.

[Russell Hafter News]

In article <59db47a2...@waitrose.com>, Chris Newman

<cvj...@waitrose.com> wrote:

> In days of yore when Gmail was simple I got several
> accounts for different purposes.

I would dump Google after having got some other e-mail
addresses. And yes, getting your own domain, probably (as
others have suggested) via Orpheus or xenCentric (who I have
used for many years).

Once you have your own domain, even if you only have one
e-mail adress, you can set up an unlimited number of aliases
and Pluto can sort each alias into its own box.

If you feel that you need to keep the google e-mail
addresses, you can go into the Google settings and forward
all the e-mail to your new e-mail addresses.

It should also be perfectly straightforward to send your
e-mails to appear as if they have come from the google
e-mail address.

I have been doing all this for around a year now with e-mail
to/from myself @ a google-hosted domain.



If you feel that you

--
Russell
Russell Hafter
E-mail to russell at russellhafter dot me dot uk
Need a hotel? <http://www.hrs.com/?client=en__blue&customerId=416873103>
Friendly web hosting <https://www.xencentrichosting.uk/billing/aff.php?aff=7>

[Richard Darby (news)]

In article <b0eec7db...@mytarbis.plus.com>,

Chris Hughes <new...@noonehere.co.uk> wrote:
> In message <59dbaed9...@waitrose.com>
> Chris Newman <cvj...@waitrose.com> wrote:

> > In article <5ffe8fdb...@mytarbis.plus.com>,
> > Chris Hughes <new...@noonehere.co.uk> wrote:
> >> In message <59db47a2...@waitrose.com>
> >> Chris Newman <cvj...@waitrose.com> wrote:

> >>> Hi,

> >>> There is a thread on the ROOL forum regarding Google withdrawing
> >>> "Less secure app" access. No firm conclusion seems to have been
> >>> reached.

> > <Big snip>

> >> I have two personal domains and of course the WROCC one I use. I use
> >> 20i.com for my personal domains now.

> > Thanks for the input Chris.

> > Next question. Which are the best domain companies to start looking at?

> My suggestions is go for somewhere who can help you, especially if you
> just want email hosting.

> Orpheus Internet is an obvious one here, but I do suggest speaking to
> Richard Brown - They will be at the Wakefield Show in May

> XenCentric Hosting (formerly known as Purley Hosting and Spellings) run
> by Neil Spellings - so knows about RISC OS as well.

> Those would be my initial suggestions, you can always migrate them to
> another hosting provider later.

I agree with Chris. My personal domain is hosted by Orpheus and I look
after two other domains hosted over the years by
Spellings/Purley/Xencentric. I find support is very good from both
Richard Brown and Neil Spellings. All email accounts work without a
problem with Netfetch/Hermes/Pluto.

Richard Darby.

--

Richard Darby.
website: http://www.rjdarby.co.uk
Do not reply to this address all mail is deleted.
Reply to: <my first name> at <my domain>

[Chris Newman]

In article <59dc073e...@russellhafter.me.invalid>,

Russell Hafter News <see...@russellhafter.me.invalid> wrote:
> In article <59db47a2...@waitrose.com>, Chris Newman
> <cvj...@waitrose.com> wrote:

> > In days of yore when Gmail was simple I got several
> > accounts for different purposes.

> I would dump Google after having got some other e-mail
> addresses. And yes, getting your own domain, probably (as
> others have suggested) via Orpheus or xenCentric (who I have
> used for many years).

> Once you have your own domain, even if you only have one
> e-mail adress, you can set up an unlimited number of aliases
> and Pluto can sort each alias into its own box.

> If you feel that you need to keep the google e-mail
> addresses, you can go into the Google settings and forward
> all the e-mail to your new e-mail addresses.

> It should also be perfectly straightforward to send your
> e-mails to appear as if they have come from the google
> e-mail address.

> I have been doing all this for around a year now with e-mail
> to/from myself @ a google-hosted domain.

Thanks for everyone's help. I didn't realize Orpheus did domains without
Richard being my ISP.

--
Chris Newman

[Chris Newman]

In article <59dc073e...@russellhafter.me.invalid>,
Russell Hafter News <see...@russellhafter.me.invalid> wrote:

> In article <59db47a2...@waitrose.com>, Chris Newman
> <cvj...@waitrose.com> wrote:

> > In days of yore when Gmail was simple I got several
> > accounts for different purposes.

> I would dump Google after having got some other e-mail
> addresses. And yes, getting your own domain, probably (as
> others have suggested) via Orpheus or xenCentric (who I have
> used for many years).

I looked at https://www.xencentrichosting.uk/ but when I went to "Our
Solutions" -> "Domain Registration" there was a re-direct which I
couldn't get to work.

Orpheus site worked OK.

--
Chris Newman

[Richard Darby (news)]

In article <59dd50e1...@waitrose.com>,

Chris Newman <cvj...@waitrose.com> wrote:
> In article <59dc073e...@russellhafter.me.invalid>,
> Russell Hafter News <see...@russellhafter.me.invalid> wrote:
> > In article <59db47a2...@waitrose.com>, Chris Newman
> > <cvj...@waitrose.com> wrote:

> > > In days of yore when Gmail was simple I got several
> > > accounts for different purposes.

> > I would dump Google after having got some other e-mail
> > addresses. And yes, getting your own domain, probably (as
> > others have suggested) via Orpheus or xenCentric (who I have
> > used for many years).

> I looked at https://www.xencentrichosting.uk/ but when I went to "Our
> Solutions" -> "Domain Registration" there was a re-direct which I
> couldn't get to work.

> Orpheus site worked OK.

What browser were you using? You need to use a modern capable browser on
Xencentric site. For RISC OS anything less than Iris may give problems.

[Chris Newman]

In article <59dd520...@rjdarby.co.uk>, Richard Darby (news)

<ne...@rjdarby.co.uk> wrote:
> In article <59dd50e1...@waitrose.com>, Chris Newman
> <cvj...@waitrose.com> wrote:
> > In article <59dc073e...@russellhafter.me.invalid>, Russell
> > Hafter News <see...@russellhafter.me.invalid> wrote:
> > > In article <59db47a2...@waitrose.com>, Chris Newman
> > > <cvj...@waitrose.com> wrote:

> > > > In days of yore when Gmail was simple I got several accounts for
> > > > different purposes.

> > > I would dump Google after having got some other e-mail addresses.
> > > And yes, getting your own domain, probably (as others have
> > > suggested) via Orpheus or xenCentric (who I have used for many
> > > years).

> > I looked at https://www.xencentrichosting.uk/ but when I went to
> > "Our Solutions" -> "Domain Registration" there was a re-direct which
> > I couldn't get to work.

> > Orpheus site worked OK.

> What browser were you using? You need to use a modern capable browser
> on Xencentric site. For RISC OS anything less than Iris may give
> problems.

Tried Iris on RISC OS and Opera on Windows.

--
Chris Newman

[Richard Darby (news)]

In article <59dd52b6...@waitrose.com>,

Chris Newman <cvj...@waitrose.com> wrote:
> In article <59dd520...@rjdarby.co.uk>, Richard Darby (news)
> <ne...@rjdarby.co.uk> wrote:
> > In article <59dd50e1...@waitrose.com>, Chris Newman
> > <cvj...@waitrose.com> wrote:
> > > In article <59dc073e...@russellhafter.me.invalid>, Russell
> > > Hafter News <see...@russellhafter.me.invalid> wrote:
> > > > In article <59db47a2...@waitrose.com>, Chris Newman
> > > > <cvj...@waitrose.com> wrote:

> > > > > In days of yore when Gmail was simple I got several accounts for
> > > > > different purposes.

> > > > I would dump Google after having got some other e-mail addresses.
> > > > And yes, getting your own domain, probably (as others have
> > > > suggested) via Orpheus or xenCentric (who I have used for many
> > > > years).

> > > I looked at https://www.xencentrichosting.uk/ but when I went to
> > > "Our Solutions" -> "Domain Registration" there was a re-direct which
> > > I couldn't get to work.

> > > Orpheus site worked OK.

> > What browser were you using? You need to use a modern capable browser
> > on Xencentric site. For RISC OS anything less than Iris may give
> > problems.

> Tried Iris on RISC OS and Opera on Windows.

Try it again today, it may have been a glitch. If no joy, email
sup...@xencentrichosting.uk to report it to Neil.

[Chris Newman]

In article <59dd916...@rjdarby.co.uk>, Richard Darby (news)

Forgot to say I've contacted Neil. 'Twas a glitch with the site. Now
sorted

--
Chris Newman

[Barry Punchard]

I know this has been discussed here and elsewhere and I have that same problem,
using Messenger and Netfetch with a Google email account.

What is the summary answer, please? Google are still pushing this as something
they will do imminently - like in a few weeks. So is this something a change in
RISCOS/ RComp software is planning to deal with?

a) If so, can we expect modified software to be made available soon?

b) Or, has a step by step alternative been produced?

b) Do I have to drop gmail and have all the hassle that entails? I've used POP3
for so long and don't want webmail, because of being stuck with their appalling
email management software.

I am abroad and don't feel I can deal with anything other than a simple solution
with little technical involvement.

Sorry, if the answer is already contained in the above that I haven't absorbed.
Thanks,
Barry
--
__ ___
//_)) //__))
//__))arry //unchard mailto:barry.p...@gmail.com
____________________

[Harriet Bazley]

On 16 May 2022 as I do recall,

Barry Punchard wrote:

> On 19 Apr cvj...@waitrose.com wrote:
>
> >
> > There is a thread on the ROOL forum regarding Google withdrawing "Less
> > secure app" access. No firm conclusion seems to have been reached.

[snip]

> I know this has been discussed here and elsewhere and I have that same
> problem, using Messenger and Netfetch with a Google email account.
>
> What is the summary answer, please? Google are still pushing this as something
> they will do imminently - like in a few weeks. So is this something a
> change in RISCOS/ RComp software is planning to deal with?
>
> a) If so, can we expect modified software to be made available soon?
>
> b) Or, has a step by step alternative been produced?
>

Chris Newman posted a step-by-step alternative in
comp.sys.acorn.networking. It requires one-off web access to GMail (so
won't work with NetSurf) and one-off access to a mobile phone, but after
that you can continue to access your e-mail via Netfetch and POP3.

---------- Begin forwarded message ----------
Date: Mon, 09 May 2022 00:20:12 +0100
From: Chris Newman <cvj...@waitrose.com>
Newsgroups: comp.sys.acorn.networking
Subject: Re: Google and the end of May

In article <6da978e15...@bazleyfamily.co.uk>, Harriet Bazley
<har...@bazleyfamily.co.uk> wrote:
> On 30 Apr 2022 as I do recall, Chris Newman wrote:

> [snip]

> > As I understand it, if you wish to keep accessing Google on older
> > (Less secure?) kit you will need to get a new password to put in to
> > your mail transport prog. This only needs to be done once unless you
> > have some sort of catastrophic failure of your set up. Presumably
> > even then, if you've saved it, you can re-insert. You can still log
> > in online with your original password. Then each time you connect
> > with said older kit, you will have to get a 2 factor code from them.
> > Whether that arrives by phone, mail or what I know not.


> Ouch. So *every single time* your mail transport tries to fetch from
> your inbox, you will have to manually confirm your identity... i.e.
> every twenty minutes or so?
Seemingly, its not as bad as I thought. You won't need to confirm every
time.
Thanks to an article in Computer Active magazine, I've sorted the first
of my Google accounts.

I've tried to make an idiot's guide. Herewith....

2 factor authentication for "insecure" apps.

Sign into your Google account.
Select "Security" in the left hand menu.
You may have to keep signing back into you account to verify it's you
during the process.
Follow instructions to enable 2-step verification.
You will need a phone for the set up as they send you a code. I had one
listed with them as I have an Android phone which needs the ridiculously
named "PlayStore."
You can ignore the bits about further safety measures.
Go back to "Security" page.
With a bit of searching you should see a new option "App Passwords"
Select "Mail" in the "Select App" drop down menu no matter what
app/client/transport you are using.
In the "Select device" menu, choose the device you want to access gmail
on. I chose other and when asked, called it Hermes.
Select "Generate" to get you 16 digit password which appears in a
yellowish box.
Enter this in your email/transport client in place of you old code.
You should only have to do this once but keep a copy of the code in case
of disasters. If the worst comes to the worst, you can get Google to
generate a new one.
You may have to do a capcha or get another code. I was so confused, I
slightly disremember the order of events.
Then all should work.

When I accessed my Google account on-line it was my original password
that was needed. I had to get a code to log in the first time but there
is a "Don't ask again on this device" box to tick to prevent that each
time you login in future.

How does it know my device? IP address, MAC address?

--
Chris Newman
----------- End forwarded message -----------


--
Harriet Bazley == Loyaulte me lie ==

The way to a man's heart is through the left ventricle.

[Chris Hughes]

In message <406d61e959.b...@barry.gmail.com>

R-Comp are aware and looking at options, but it should still work
afterwards anyway by changing to an 'application password' generated by
Google, rather then your own.

> b) Or, has a step by step alternative been produced?

One has been published in these lists, and on ArchiveOnline

> b) Do I have to drop gmail and have all the hassle that entails? I've used
> POP3
> for so long and don't want webmail, because of being stuck with their
> appalling
> email management software.

Although I do have a gmail account mainly as a backup. I have my own
domains so I control my email not Google or my ISP.


[snip]

[Harriet Bazley]

On 16 May 2022 as I do recall,

Harriet Bazley wrote:

[snip]

> Sign into your Google account.
> Select "Security" in the left hand menu.
> You may have to keep signing back into you account to verify it's you
> during the process.
> Follow instructions to enable 2-step verification.
> You will need a phone for the set up as they send you a code. I had one
> listed with them as I have an Android phone which needs the ridiculously
> named "PlayStore."

Note that once you have done this you will now be unable to access your
webmail without a mobile phone (which is why I was putting off doing it)
- you will only have POP3 access!

--
Harriet Bazley == Loyaulte me lie ==

He who hesitates is sometimes saved.

[Barry Punchard]

On 16 May har...@bazleyfamily.co.uk wrote:

> On 16 May 2022 as I do recall,
> Barry Punchard wrote:
[snip]
>
> I know this has been discussed here and elsewhere and I have that same
> problem, using Messenger and Netfetch with a Google email account.
>
> What is the summary answer, please? Google are still pushing this as something
> they will do imminently - like in a few weeks. So is this something a
> change in RISCOS/ RComp software is planning to deal with?
>

> [SNIP]

>
> b) Or, has a step by step alternative been produced?
>
> > Chris Newman posted a step-by-step alternative in

[SNIP]

Thank you very much Chris and Harriet. That all went well with 3 mail addresses.
so that problem is dealt with until Google feel so concerned about MY security
that they introduce another hurdle.

[Barry Punchard]

Thanks for the comments Chris H. I hope to return to live in the UK soon and do
the same eventually.