It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled.

Why doesn't outlook 2013 meet modern security standards?

  • security.stackexchange.com/q/70719/49075 ​ ​
    – user49075
    Jan 26, 2016 at 8:32
  • @RickyDemer That has nothing to do with the question
    – Stephane
    Jan 26, 2016 at 8:51
  • @Stephane : ​ See "with SSL protocol". ​ ​ ​ ​
    – user49075
    Jan 26, 2016 at 8:59
  • @RickyDemer The gmail flag doesn't have anything to do with SSL. It's about SASL
    – Stephane
    Jan 26, 2016 at 9:00

1 Answer 1


That specific GMail account flag simply allows system that uses standard SMTP to connect without using OAUTH2.

The only secure password authentication method gmail allows SMTP clients to use is a (non.standard) XOAUTH2 SASL mechanism (the correct tag is actually OAUTHBEARER).

GMail has decided to refuse all other secure login mechanism: you're either using their own flavor of OAUTH2 SASL or you need to enable that flag and use the LOGIN (i.e. cleartext) password. Security-wise, your password is still proetcted by the TLS encryption. What changes is that the client application needs to keep your password in an encrypted format while, with OAuth, it keeps an access token (a per-application password, if you want).

In other words: it's not that Outlook does not "meet modern security standards", it's that google have a very peculiar view of what these standards are.

  • 1
    @ncomputers.org you may wish to generate an app specific password to ensure you don't need to use your primary google password Google Support Page Jan 26, 2016 at 9:03
  • 1
    @AlexKeySmith It's a good choice. We'll recommend it :D Thank you very much!
    – ncomputers
    Jan 26, 2016 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .