OAuth token vs. application-specific password: any meaningful benefit?

Question

I feel like this should be a duplicate, but I don't see it anywhere.

The question is pretty simple. When giving a mail client (say, Thunderbird) access to your e.g. Gmail account, you have the option of either using an application-specific password, or an OAuth token.

For the life of me, I don't understand the benefit of the OAuth token:

• Both are used only for that specific application
• Both are cryptographically secure against cracking
• Both allow full access to the user's emails
• Both can be later revoked by the user

On the other hand, the downside is that it's less universally supported and requires jumping through more hoops to set up.

So why in the world would I use a longer OAuth token over a shorter application-specific password? What benefits does it have—i.e. under what attack scenarios will I be glad to have used OAuth?

Answer 1

Using an app-specific password requires going into the target service, generating a new app-specific password, going to the destination app (Thunderbird, in this case) and entering the credentials.

Using OAuth only requires opening Thunderbird, adding your account using your normal username/password, and then clicking a button to approve that you want OAuth to set the permissions up for you. You never see the password/token, you have nothing to copy/paste, etc. So, it's easier to set up (usually), is safer, in the sense that you never see the password/token and nobody could look over your shoulder to jot it down to use as a backdoor access (masquerading as whatever app you generated it for, even though it really isn't - there's nothing stopping you from using an app-specific password on multiple devices simultaneously), whereas the OAuth token is literally on an app-by-app basis (unless I'm misinformed).