2

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled.

Why doesn't outlook 2013 meet modern security standards?

  • security.stackexchange.com/q/70719/49075 ​ ​ – user49075 Jan 26 '16 at 8:32
  • @RickyDemer That has nothing to do with the question – Stephane Jan 26 '16 at 8:51
  • @Stephane : ​ See "with SSL protocol". ​ ​ ​ ​ – user49075 Jan 26 '16 at 8:59
  • @RickyDemer The gmail flag doesn't have anything to do with SSL. It's about SASL – Stephane Jan 26 '16 at 9:00
5

That specific GMail account flag simply allows system that uses standard SMTP to connect without using OAUTH2.

The only secure password authentication method gmail allows SMTP clients to use is a (non.standard) XOAUTH2 SASL mechanism (the correct tag is actually OAUTHBEARER).

GMail has decided to refuse all other secure login mechanism: you're either using their own flavor of OAUTH2 SASL or you need to enable that flag and use the LOGIN (i.e. cleartext) password. Security-wise, your password is still proetcted by the TLS encryption. What changes is that the client application needs to keep your password in an encrypted format while, with OAuth, it keeps an access token (a per-application password, if you want).

In other words: it's not that Outlook does not "meet modern security standards", it's that google have a very peculiar view of what these standards are.

  • 1
    @ncomputers.org you may wish to generate an app specific password to ensure you don't need to use your primary google password Google Support Page – Alex KeySmith Jan 26 '16 at 9:03
  • 1
    @AlexKeySmith It's a good choice. We'll recommend it :D Thank you very much! – ncomputers Jan 26 '16 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.