Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled.
The client is configured to use SSL for IMAP (and SMTP).
What settings is Yahoo looking for to consider an IMAP client to be secure?
That setting is used to block (or permit) password auth to Yahoo's POP3/IMAP/SMTP servers. They want you to use OAuth tokens instead.
The advantage of OAuth is that the app itself doesn't actually store your password - in fact, needn't ever even see your password - and has only an app-specific access token and refresh token. The use of those tokens can be tracked individually, and revoked at need, without impacting other apps (unlike a password). The token also can't be used to sign into the web portal and do things like change settings, again, unlike a password.
Still, the way they will prompt you every single time you log in to "disable insecure access" is intensely irritating, especially because they don't know how the clients are storing those passwords (for example, if I don't have Outlook store the password and just enter it every time I sign in, then most of their concern is irrelevant) and also because training people to click through scary-looking warnings is a TERRIBLE thing to do.
