When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled.

The client is configured to use SSL for IMAP (and SMTP).

What settings is Yahoo looking for to consider an IMAP client to be secure?

1 Answer 1


That setting is used to block (or permit) password auth to Yahoo's POP3/IMAP/SMTP servers. They want you to use OAuth tokens instead.

The advantage of OAuth is that the app itself doesn't actually store your password - in fact, needn't ever even see your password - and has only an app-specific access token and refresh token. The use of those tokens can be tracked individually, and revoked at need, without impacting other apps (unlike a password). The token also can't be used to sign into the web portal and do things like change settings, again, unlike a password.

Still, the way they will prompt you every single time you log in to "disable insecure access" is intensely irritating, especially because they don't know how the clients are storing those passwords (for example, if I don't have Outlook store the password and just enter it every time I sign in, then most of their concern is irrelevant) and also because training people to click through scary-looking warnings is a TERRIBLE thing to do.

  • Thank you! They used to have a Generate token option. Where is it now? Jun 13, 2017 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .