ATT/Yahoo email - OAuth ?

[PS56k]

Just noticed this on the ATT/Yahoo email support page -

https://www.att.com/esupport/article.html#!/email-support/KM1240462

what does it mean for us Tbird users ?


Use OAuth or secure mail key for email apps

We’re enhancing the security of AT&T email. Soon you’ll have to use
either OAuth or a secure mail key to get your AT&T email through an
email app.

[userDave]

I recently moved to another State and my provider isn't in the area. I
had to use ATT for my e-mail. It seems ATT wants customers to use Yahoo
webmail more than anything else, but have claims of a very limited set
of clients and operating systems they will accept.

I currently have that problem, I think. It just says server error at the
final step when Thunderbird is checking the connection. I'm following
the instructions they have specifically for Thunderbird. I guess old
information at ATT.

At the link PS56k posted, they write, "Your app may offer you a list of
email providers that includes Yahoo. If it does, your email app is OAuth
compatible. Be sure to select Yahoo as your provider. You’re all set!"

Not sure I would be "all set!" I lost the expectation of security at
Yahoo a few million compromised users ago. I won't use the web
interface, but I can't get the Thunderbird client to work.

I wonder if OAuth keeps the e-mail secure from anyone but the recipient.
Does this mean that Yahoo won't monetize our e-mail content or put in
advertising?

[WaltS48]

Well, my Gmail account has OAuth2 as the "Authentication Method", so
OAuth2 works in Thunderbird.

Or you could follow the instructions to create a secure mail key.

<https://www.att.com/esupport/article.html#!/email-support/KM1240308>

--
CPU: 3.2 Ghz AMD Athlon(tm) II X3 455 Processor
RAM: 8 GiB
Graphics: GeForce GT 630/PCIe/SSE2
OS: Ubuntu Linux 16.04LTS - Unity Desktop

[userDave]

On 6/23/2018 7:48 AM, WaltS48 wrote:
> On 6/23/18 12:36 AM, PS56k wrote:
>> Just noticed this on the ATT/Yahoo email support page -
>>
>> https://www.att.com/esupport/article.html#!/email-support/KM1240462
>>
>> what does it mean for us Tbird users ?
>>
>>
>> Use OAuth or secure mail key for email apps
>>
>> We’re enhancing the security of AT&T email. Soon you’ll have to use
>> either OAuth or a secure mail key to get your AT&T email through an
>> email app.
>>
>
> Well, my Gmail account has OAuth2 as the "Authentication Method", so
> OAuth2 works in Thunderbird.
>
> Or you could follow the instructions to create a secure mail key.
>
> <https://www.att.com/esupport/article.html#!/email-support/KM1240308>
>

OAuth2 is not supported by the server. At least it's not mentioned in
the documentation. I tried it and Thunderbird returned a warning that
the Authentication method was not supported by the mail server.

Of course, PS56k should try the instructions at ATT. As I wrote, I did
that and I reported it does not work. PS56k, if you try it and it works,
I would really like to know what I'm doing wrong. I followed the
instructions 100%. Interesting that ATT has instructions for Thunderbird
but in the other article specifically say it doesn't work for Thunderbird.

For reference, the details on ATT email support is here:
https://www.att.com/esupport/article.html#!/email-support/KM1240462

On that page is a link to "Troubleshoot & Resolve" which is where I went
to get the instructions for my e-mail client. I believe you must be
logged into your att.net account for that to properly work. It appears
to look up details of my account to assure context and accuracy of
instructions.

[WaltS48]

On 6/23/18 12:48 PM, userDave wrote:
> On 6/23/2018 7:48 AM, WaltS48 wrote:
>> On 6/23/18 12:36 AM, PS56k wrote:
>>> Just noticed this on the ATT/Yahoo email support page -
>>>
>>> https://www.att.com/esupport/article.html#!/email-support/KM1240462
>>>
>>> what does it mean for us Tbird users ?
>>>
>>>
>>> Use OAuth or secure mail key for email apps
>>>
>>> We’re enhancing the security of AT&T email. Soon you’ll have to use
>>> either OAuth or a secure mail key to get your AT&T email through an
>>> email app.
>>>
>>
>> Well, my Gmail account has OAuth2 as the "Authentication Method", so
>> OAuth2 works in Thunderbird.
>>
>> Or you could follow the instructions to create a secure mail key.
>>
>> <https://www.att.com/esupport/article.html#!/email-support/KM1240308>
>>
> OAuth2 is not supported by the server. At least it's not mentioned in
> the documentation. I tried it and Thunderbird returned a warning that
> the Authentication method was not supported by the mail server.

Maybe both of you should follow the directions for creating a secure
mail key?

Scroll down the page I linked to until you reach "Create a secure mail
key". Click "Show more".

Of course if you refuse to use the web interface. Well...

It confuses me why ATT would want users to use a Verizon company. Did
Verizon also buy ATT?

[userDave]

Walt, that is included in the ATT instructions for setting up
Thunderbird. Establishing a secure mail key is the first thing one is to
do. Both PS56k and I linked the page and I, (and I expect PS56k), saw
that. As I reported, I tried setup per the ATT instructions. Although, I
know experiences with PC and software can vary among users, so I
recommended PS56k try this. I hope for the best of results.

ATT writes that most people want to use an e-mail client. The greater
utility of an e-mail client over a web interface is why I try to use
Thunderbird over any web interface. And, I have trust issues with a
company (Yahoo) that has repeatedly compromised the private information
of millions of users over the years.

ATT has had a relationship with Yahoo for e-mail services for a long
time. Since Verizon bought Yahoo last year, I expect this could be part
of the support problem at ATT.

[WaltS48]

It wasn't clear to me what instructions you followed.

I understand the instructions to indicate setting up a secure mail key
is separate from, and not required for OAuth use.

[Keith Nuttle]

On 6/23/2018 12:48 PM, userDave wrote:
> On 6/23/2018 7:48 AM, WaltS48 wrote:
>> On 6/23/18 12:36 AM, PS56k wrote:
>>> Just noticed this on the ATT/Yahoo email support page -
>>>
>>> https://www.att.com/esupport/article.html#!/email-support/KM1240462
>>>
>>> what does it mean for us Tbird users ?
>>>
>>>
>>> Use OAuth or secure mail key for email apps
>>>
>>> We’re enhancing the security of AT&T email. Soon you’ll have to use
>>> either OAuth or a secure mail key to get your AT&T email through an
>>> email app.
>>>
>>
>> Well, my Gmail account has OAuth2 as the "Authentication Method", so
>> OAuth2 works in Thunderbird.
>>
>> Or you could follow the instructions to create a secure mail key.
>>
>> <https://www.att.com/esupport/article.html#!/email-support/KM1240308>
>>

I think we are getting a head of ourselves, myself included.

The first sentences from the article at the urls are:

Use OAuth or secure mail key for email apps

"We’re enhancing the security of AT&T email. SOON you’ll have to use

either OAuth or a secure mail key to get your AT&T email through an
email app."

In several other links from that page it says (as I understand) is a
feature that is coming in the next months that we should be prepared to
do WHEN it occurs.

Also because it is an alert to a future change some URL's do not work.

[userDave]

I'm jumping ahead just to get Thunderbird connected to ATT. Secure mail
key doesn't work for me and that is already here according to their two
different e-mail client support pages. Regardless, I'm not sure its a
good assumption that ATT keeps their website up-to-date and consistent.

Do they mean OAuth 1 or 2? OAuth 2 is not compatible to 1. Thunderbird
is OAuth 2; one of the few e-mail clients to be at 2. OAuth ref:

https://www.oauth.com/oauth2-servers/differences-between-oauth-1-2/

For e-mail, mozillaZine says OAuth is almost no value added and it's
more of a way to get people off e-mail clients for accessing e-mail.
I've see this theory stated from other sources, too. Ref:

http://kb.mozillazine.org/Using_Gmail_with_Thunderbird_and_Mozilla_Suite

ATT offers the comforting advise if you have client problems:

"Or, you can always use a browser to sign in directly to your AT&T email
at att.net, without using an email program or app."

This is to Yahoo who has said they want OAuth to connect better to the
social media platforms. It's a business plan. As is the desire to use
their web application for your PC e-mail access.

[Keith Nuttle]

I hope you are wrong. ATT is a disaster. Their customer service is
poor and their ISP service is not any better. The advertise 12 mbs
while on burst they do deliver that the down time in the connection for
the URL and access, cuts that to about 3 or 4. This is base on the same
laptop connected to other ISP. Recently I have to do factory resets on
the router/modem a couple of times per month.

Webmail performance leaves a lot to be desired, as the response time to
go to different folders, is quite slow. This means that it takes 2 to 3
times as long to access and review your mail, as it takes for a stand
alone program like Thunderbird.

Yet we do not have an option but to live with ATT.