I feel like this should be a duplicate, but I don't see it anywhere.
The question is pretty simple. When giving a mail client (say, Thunderbird) access to your e.g. Gmail account, you have the option of either using an application-specific password, or an OAuth token.
For the life of me, I don't understand the benefit of the OAuth token:
- Both are used only for that specific application
- Both are cryptographically secure against cracking
- Both allow full access to the user's emails
- Both can be later revoked by the user
On the other hand, the downside is that it's less universally supported and requires jumping through more hoops to set up.
So why in the world would I use a longer OAuth token over a shorter application-specific password? What benefits does it have—i.e. under what attack scenarios will I be glad to have used OAuth?