What are less secure apps, and why is my Gmail not working?
Hi everyone.
Leo Notenboom here for askleo.com. This is a question that I expect to come up
actually a lot in the next couple of weeks as Google turns on a security feature.
Or rather, it turns off the option to opt out of this security feature.
Let's take a look at what it means to be
a less secure app when it comes to email in Google's eyes and what your
alternatives are when that option to use a less secure app goes away.
Less secure apps are really simple.
A less secure app is any email program
like Thunderbird or Outlook from Microsoft Office or Eudora,
an old one, or any number of others that you run on your desktop PC or your
laptop or your Mac, or even your mobile device.
The key there is that it's a program
running on your device to which you give your email address and a password, the same
password that you use to sign into your account.
Normally, that's not secure.
And the reason it's not secure,
or the reason it's less secure in Google's eyes is that they have no control over how
that password is stored by the application.
It's the same password you would use
to sign in if you were going to go gmail.com on the web.
So there's a risk that by using that same
password in these other programs, it could accidentally be exposed and your
entire Google account could be at risk because of it.
So if you're just logging in using your email program, using an email address
and password, then you're using a less secure app.
Presumably Google has already been warning you about that.
Now, I do need to be clear.
This doesn't mean every time you fire up the app, you have to enter in a password.
This happens actually when you first
configure the account in your email program.
This may be something you did a couple of years ago.
For all I know, that's probably a less
secure app because the alternatives weren't even available a few years ago.
The alternatives that Google wants you
to move to actually changes how you authenticate your email program to use
your Google email account, the preferred solution is an email program
that knows how to use an alternate means of Authenticating you.
Most modern email programs the current version of Thunderbird,
Outlook from Microsoft Office, the mail program with Windows.
They all understand this new technique.
It boils down to this when you configure your email account in your email program.
Instead of saving your email address and password in the program,
you give it your email address, and the program hands off the job
of Authenticating you to the service providing that email.
So in the case of Google, which we're talking about here today,
when you try and add a Google email account to one of these programs
that understands the new way of doing things what will happen is rather than
the email program taking your password, a dialog box will pop up from Google.
That dialog box is actually displayed by Google directly, not your email program.
This allows for a couple of different things.
One, of course, it allows you to enter in your password great same password
you've been using as if you were using it anywhere else.
It also enables two factor authentication.
Google can actually walk through the steps of two factor authentication
at that point, something your email program was unable to do in the past.
That's the big reason that this is there once you've authenticated.
Once you've successfully supplied your password or done your two factor or
whatever it is you would normally do to authenticate with Google directly.
It then gives your email program a secure token that the email program then saves.
That token then says, in effect, yes, this guy logged in successfully.
This allows you to connect to the email
account without having to ask for the password over and over again,
or without having to authenticate over and over again, just like it did in the past.
Your email program now is not storing your password, but instead storing this token
that it got from Google that says you're authorized to access the account.
Now what if you have an older email
program that doesn't support this automatically new way of Authenticating?
Well, there is an alternate solution, but it has a requirement.
That requirement is that you must set up two factor authentication.
Two factor authentication.
I highly recommend it.
Google allows for multiple different approaches to two factor authentication.
I recommend you set them up.
Set up multiple ones so you have different
ways should you ever lose your second factor or one of your second factors.
But the bottom line is that once you've enabled two factor authentication on your
Google account, they also make available what are called app passwords.
These are passwords that are generated
by Google that you would then use in your old email program.
So the approach to configuring an old email program for a Google account would
be to supply your email address, go to your Google account on which you've
already enabled two factor authentication, request an app password.
Copy and paste that app password into your
email program, which would then allow it to authenticate
using your email address and this app password.
It's important to understand that the app password is not something you create.
It's not your normal password.
It's created by Google specifically for this kind of scenario.
So what if you have an old email program that doesn't support the new
authentication mechanism and you don't want two factor authentication?
Well, you're kind of out of luck.
The only option you really have in a case like that is that you need to update
to an email program that supports this new style of authentication.
Most of the modern ones do.
It shouldn't be that hard to find one.
Like I said, the current version of Thunderbird absolutely does.
The email program that comes with Windows absolutely does.
The versions of Office Outlook that are currently released do other email programs
you'll have to research, but the bottom line is that this is
the way that you'll need to authenticate with your Google account,
either using this new technique as supported by your email program or using
an app password after you've enabled two factor authentication.
Now there are a couple of caveats here.
The other solution, of course is to not use a desktop email program.
You could just use gmail.com or mail.Google.com on the web.
This doesn't affect any of that.
Everything you've been doing to sign in to Gmail on the web not a problem.
This only applies to third party programs.
That's a solution.
If you don't want two factor and you've
got an old email program that you don't want to upgrade, then you can bypass all
this simply by going to gmail.com on the web as your email interface.
The other thing that's important to realize is that this may manifest as
your email program simply asking for your password over and over and over again.
Make sure that when that happens, you've got the opportunity to either
change or re authenticate using the new technique.
For some email programs,
that might mean having to recreate the account in your email program.
You'll have to check with your email
program to understand exactly what it's going to take.
If you've got an old email program,
the app password approach really is the recommended one and yes,
it requires two factor authentication, but you know what?
That's recommended too.
I hope this helps explain what's happening and why you might have trouble logging
into your Gmail account once this deadline comes and goes.
There are simple solutions that do require a little bit of work on your part.
In the end, it will mean that your account is more secure.
For links, for updates, for comments and more visit Askleo.com/145891.
I'm Leo Notenboom and this is Askleocom.
Thanks for watching.