Unable to setup GMail account - Error 401: disabled_client

[back2themoon]

I think somewhere above was mentioned that enabling 2FA and the "app password" method was not available any more, or it is missing some features? Is this accurate?

At this point, it seems that simply enabling 2FA on the Google account and using "Normal password" authentication on Epyrus (with a generated "app password") would work much more reliably.

[athenian200]

At this point, it seems that simply enabling 2FA on the Google account and using "Normal password" authentication on Epyrus (with a generated "app password") would work much more reliably.

The issue is that Google seems to be phasing that out slowly, but randomly... some accounts can still use the app password and some can't. That's my understanding of the situation? Either way, the reason I want to try and get this working better (to the extent I can) is precisely because I am not certain the app password method will always work, I think eventually it will be OAuth2 or nothing.

Also, I kind of need OAuth2 for a couple of my personal e-mail addresses that are not Google, and so far my only solution has been "use webmail," and I can't use those accounts with Epyrus period. They require both 2FA and OAuth2. The Google version of OAuth2 is all Epyrus supports (badly), other OAuth2 providers don't work at all, pretty much. So I definitely have a vested interest in getting this to work at some point, because I am not really in a position where I can just transition to self-hosted e-mail or some random FOSS thing that's more compatible with Epyrus.

[Bilbo47]

I screwed up because the browser was logged in to a different, similarly named Ggl account. Dropped and re-added 2-Step Verification using the same phone number ... now the Ggl account that had App Passwords yesterday no longer has them

Was also able to follow instructions and create new app passwords, so the non-Ep client works using them, and the Ep test profile can use them as well. As you might expect, the documentation by Ggl on this is difficult to follow and perform. Agree they intend to disallow normal IMAP access eventually.

[back2themoon]

I'll just report that I successfully enabled "App passwords" for all my Google accounts. Epyrus works much better for me this way (Normal password instead of OAuth2).

Enabling 2FA is a required step of course. If you still can't find the App passwords section in your Google Account settings, try searching for it in the top search box. If still not there try adding "authenticator app" as a Sign-in step in the Security settings. I think in one case "App passwords" only appeared after adding the above, but I'm not 100% sure of this.

[moonbat]

I think in one case "App passwords" only appeared after adding the above

Not in one case, 2FA is mandatory if you want to use app passwords. And you should be using 2FA anyway for all services that support it, given the increased rate of password breaches. Make sure you don't use SMS for 2 factor, as that can also be hacked by SIM cloning.

[back2themoon]

Not in one case, 2FA is mandatory if you want to use app passwords.

That was only meant for "App passwords", since it has been mentioned they may be have been removing the feature for some users - even with 2FA enabled. I didn't experience that though, the option was there.

[Bilbo47]

I successfully enabled "App passwords" for all my Google accounts.

Excellent!

Enabling 2FA is a required step. I think "App passwords" only appeared after adding [another auth method], but I'm not 100% sure.

Agree, as subtly implied by the instructions, the UI elements for adding App Passwords are inserted at the bottom of the page (this region is invisible at the time) only after adding 2FA or possibly an authenticator app. Have to scroll down to see the newly-existing input fields? "It's there, you just didn't see it" Good frickin' job by Ggl of hiding features it wants to abolish.

[Moonchild]

This has become more of an issue as of now, as anyone with an outlook.com/office365.com/live.com/etc. Microsoft e-mail account will have to start using OAuth2 as they are removing password authentication altogether come September.

The weird thing is I was able to set up OAuth2 for it no problem, but if I try to access other IMAP folders it suddenly complains about an unsupported Authentication method.

[Moonchild]

Holy crap it works! Epyrus accessing GMail via OAuth2 using my private developer key The instructions by Claws-mail are barely helpful. Maybe I'll write it up better tomorrow, but any HowTo will be out of date as soon as Ggl changes their UI again.

I'd appreciate some pointers how to get an OAuth2 client ID and secret. Microsoft isn't being helpful in their "we want you to use the free Outlook client" preference and not really giving any details otherwise.

[Bilbo47]

Epyrus accessing GMail via OAuth2 using my private developer key

how to get an OAuth2 client ID and secret.

The resource consulted is https://support.google.com/googleapi/answer/6158849

[Moonchild]

I'm pretty sure that wouldn't work for Microsoft who use their own authentication/server, and aren't using Google infra for OAuth2

[Bilbo47]

Microsoft isn't being helpful

Oh right. They want to not-provide keys for using their OAuth API for individuals or open source clients.

Some enterprising soul should wireshark or whatever and detect how/whether Outlook-etc works as far as manufacturing per-user keys and authenticating with them.

[athenian200]

This has become more of an issue as of now, as anyone with an outlook.com/office365.com/live.com/etc. Microsoft e-mail account will have to start using OAuth2 as they are removing password authentication altogether come September.

That's actually going to be a pretty big problem for me, because that means I won't have any regularly-used e-mail accounts to even test Epyrus with. Like, I'm sure I can keep testing basic functionality with my GMail account, but I don't really use that account other than for testing OAuth2 on Epyrus. Now that may be the only e-mail account I have that even works with Epyrus.

Overall, I'm just feeling like the writing may be on the wall as far as Epyrus being useful to me personally. I don't mind maintaining it, but I'm just not able to work within the constraints involved in using e-mail accounts that use password authentication anymore. Too many things just don't accept that now.

[Moonchild]

Too many things just don't accept that now.

The vast majority of e-mail providers use password authentication. just the behemoths (Google, Microsoft, maybe Apple in the future?) don't; or maybe it's just those that provide free e-mail and want to desperately that everyone uses server-based mail don't -- after all, password auth is what POP3 uses. Server-based mail can be harvested.

Is there anything I can sign up for that doesn't require OAuth2 that wouldn't involve me setting up my own server or paying?

I'll be more than happy to create an e-mail account for you on the palemoon.org server. No issue whatsoever. Just let me know.

[Bilbo47]

anything I can sign up for that doesn't require OAuth2 that wouldn't involve me setting up my own server or paying?

I'll be more than happy to create an e-mail account for you on the palemoon.org server. No issue whatsoever. Just let me know.

Same: can provide a non-OAuth email account at one of my domains Glad to help with the Epyrus effort.

Also, testing OAuth at MS would be a decent reason to un-delete from Epyrus my otherwise-unused account at Outlook.com

[Bilbo47]

that wouldn't work for Microsoft

Posted that because Ggl is in the name of the thread CTTOI I'm gonna open or find a thread for MS stuff.

Edit: that new thread for MS OAuth-etc is here

[UCyborg]

Am I the only one who had the idea to monitor Thunderbird's traffic to read key and secret and use them with Epyrus to bypass the nonsense with generating own key at Google? They're in plain sight.

[gabrgv]

Am I the only one who had the idea to monitor Thunderbird's traffic to read key and secret and use them with Epyrus

I changed those to the Thunderbird’s ones.

New link: https://github.com/mozilla/releases-com ... rs.sys.mjs

[UCyborg]

I see now, guess I glanced too quickly over the entire thread.

Except I didn't feel like digging through source code, but caught it when I was experimenting with Proxomitron Reborn and set it as system proxy, then it was right there in its logs.

Is it just me, or are they marketing it for "better security" for gullible people?

https://workspaceupdates.googleblog.com/2023/09/winding-down-google-sync-and-less-secure-apps-support.html

[back2themoon]

So, they are killing off the "antiquated" username/password method permanently after all. Damn them... they are so modern.

edit: No, it looks like username/password sign-in (with 2FA enabled) will still be supported I think? Again, I highly recommend this over OAuth 2 for stability and reliability.

If the app you are using does not support OAuth, you will need to switch to an app that offers OAuth or create an app password to access these apps.