Microsoft deprecation of Basic Authentication

[LeonardoCavichia]

Hello Colleagues. How does this affect the user's ability to log into Snapy using a personal or business microsoft account?

[the-djmaze]

OAuth is still not fully supported.
There are some security issues with this approach.

SnappyMail does not store passwords, but it does use it to encrypt private data like server stored PGP keys and additional accounts.

With OAuth the "password" always changes so you can't use additional acoounts.

And there are some more issues.

[the-djmaze]

I did think about using the refresh token for encryption, but the problem is that on every login this token is also refreshed.
So second idea is to only allow accounts with OAuth as additional accounts (not the primary login).
This could be a first step to at least have some sort of support.

[jonmoesli]

Roundcube sets the access token as password and uses it with IMAP (tried with dovecot and works)

[the-djmaze]

Roundcube sets the access token as password

But what if you login on device 1 and device 2 (where device can be pc, tablet, phone, etc. etc.).
Then there are 2 access tokens and refresh tokens, and which can decrypt the additional accounts?

[jonmoesli]

Mhhh, I don't know the roundcube internals sadly :-(

[the-djmaze]

If RoundCube allows additional accounts and does store the login data of those accounts, it can't encrypt them using OAuth tokens.
The only way, to my knowledge, is to use an encrypt key on the server.
But that opens a security hole as i explained at RainLoop#2134

I did think about using a "wallet password" as you use with all the password wallets apps on your computer.
But that would mean a complete different approach to use the webmail.
It would be like:

1. create a login account (not IMAP related)
2. add all your IMAP accounts

This way the login is separate from any IMAP but means that integration with cPanel, Nextcloud and many others makes it way more difficult.

Eventually we will find a good approach but OAuth as main account (with additional accounts) in webmail is a mind breaker.