Re: Back on topic.... Re: [SECURITY] University credentials used by third parties

[Mike Porter <mike () UDEL EDU>]

On Wed, 25 Aug 2010, Jesse Thompson wrote:

> On 08/25/2010 10:55 AM, Mike Porter wrote:
> > What was the violation?
>
> The obvious, unless you consider double standards a violation.
>
> > The problem that users woud need to store a password, likely the regular 
> > one, at gmail in order to use imap?
>
> right.
>
> > We ended up with a convoluted system to avoid some of those issues.
>
> Care to elaborate?  I presume that the only solution to this problem is to 
> require token-passwords for IMAP in lieu of the real passwords.

Yes.  The user can chose to send their "real" password, a random
password we will reveal to them, or a completely different password.

This causes lots of confusion.

But, not as much as Google's decision to block API based forward
setting with 0 days notice.  I'm still living with the changes that
caused.

You do get what you pay for...

Mike

> Jesse

-
Mike Porter
PGP Fingerprint: F4 AE E1 9F 67 F7 DA EA  2F D2 37 F3 99 ED D1 C2