<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">On 22 Jan 2019, at 13:27, Alain Israel wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">Same for me, Mailmate wors fine with Exchange (potential caveat , there are multiple Exchange versions), except for handling the keywords. I have never heard of Exchange that does not support imap/smtp, neither forwarding. But I am not an expert.</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">If I understand correctly then some users of Office365 are also forced to use two factor authentication (which for IMAP means the XOAUTH2 capability). The combination of IMAP and XOAUTH2 is not supported by Microsoft on <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">outlook.office365.com</code> even though it does work for <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">outlook.com</code>.</p>
<p dir="auto">Strangely, the office365.com IMAP server does advertise support for XOAUTH2, but there is no way for me (MailMate) to register at Microsoft to get the credentials needed to actually use it. A cynical brain like mine could see this as proof that the lack of support for XOAUTH2 is primarily a strategical decision.</p>
<p dir="auto">I'll go a bit off topic here. As <a href="https://blog.freron.com/2015/is-oauth2-support-a-good-thing/" style="color:#3983C4">I wrote about</a> a few years ago I worry about the use of OAuth2 in general. My worry is that big companies can use it to lock out specific email clients whenever they feel like it. This hasn't happened yet, but we are in a situation with the 3 big players using 3 different strategies:</p>
<ul>
<li>Google: Supports OAuth2 and makes it easily available for developers, but they also make non-OAuth2 access practically useless by making it hard to enable and to stay enabled. In the process, they don't hold back on scaring users with claims of third party email client access being insecure. In addition to this, Gmail IMAP (Gimap) is really not IMAP at all. It is perhaps one of the most successful examples of Microsoft's <a href="https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish" style="color:#3983C4">“Embrace, extend, and extinguish”</a> strategy.</li>
<li>Microsoft: Supports OAuth2 on <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">outlook.com</code> but refuses to support it on <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">office365.com</code> essentially preventing Office 365 users from using email clients which do not have native support for their proprietary Exchange email protocols. In addition to this, Exchange IMAP is possibly one of the most buggy IMAP implementations in widespread use.</li>
<li>Apple: Probably supports something very similar to OAuth2, but they don't make it available for third party developers. When two factor authentication is enabled Apple's own applications work very nicely, while third party applications need the users to create application specific passwords.</li>
</ul>
<p dir="auto">There are no signs that any of the above will change in the future.</p>
<p dir="auto">-- <br>
Benny</p>
</div>
</div>
</body>
</html>