[MlMt] MailMate passed the CASA tier 2 security assessment (hurrah?)

[Pierre Igot]

First of all, I want to commend Benny on his efforts to deal with this and be as transparent as possible with us users. It cannot be easy.

For what it’s worth, I currently have six accounts in MailMate, including one Fastmail account, one Apple iCloud account and one FREE Gmail account for personal use. (The other three accounts are part of a hosting service that I have for my web own domains.) I don’t mind having to deal with app-specific passwords, even if it’s a bit awkward, as long as the process is well documented somewhere.

For my main job, I also have two Exchange accounts and one Google Workspace account. My experience with systems admins in large organizations is that they’ll leave you alone as long as you find something that works for you that doesn’t trigger any alarm bells on their systems, which is not always easy. But there’s absolutely no point in trying to talk them into making any kind of an exception for you (and it’s definitely NOT a good idea to even try to “tell them that they were not doing their jobs properly”, as Benny suggested elsewhere — systems admins think they are gods and nobody is to ever question their rules and decisions).

For this reason, I have opted NOT to use MailMate for these three accounts and I use MS Outlook instead. I don’t like it, but the advantage is that it keeps the stuff related to my main job completely separate, and if there are any problems, I can always blame Microsoft/Google and let the admins deal with it.

In other words, I do have one Google Workspace account that I need to access regularly, but I don’t need to access it via MailMate, which I only use for my free personal Gmail account.

HTH

Pierre

On 9 Apr 2025, at 10:04, Benny Kjær Nielsen wrote:

> **Note:** This email is important for all Gmail users. You should read (the last part of) it before May 7, 2025.
>
> ---
>
> Hi MailMate users,
>
> ……
> ---
> ### Gmail support in the future
>
> Ok, no more ranting. What does this mean for Gmail support in the immediate future? Well, maybe not much if I understand the inner workings of Google authentication correctly.
>
> I've written a new server page describing various [account configuration](http://freron.com/account_configuration/) issues. Here is the current part on workarounds if MailMate is no longer a Google verified app:
>
> * Simple solution (OAuth-based): Google Workspace (aka G Suite aka Google Apps) users should be able to have the admin of the account explicitly allow MailMate. This should mean that OAuth still works for the account.
> * Simple solution (password-based): Free `@gmail.com` accounts do not have settings allowing the user to explicitly allow MailMate. Instead, you need an app specific password. This option is very well hidden though, but here is a [direct link](https://myaccount.google.com/apppasswords). Note that this [requires 2SV](https://support.google.com/accounts/answer/185833) to be enabled for the account.
> * Advanced solution (OAuth-based): It's also possible to make your own [app registration](https://developers.google.com/identity/protocols/oauth2/native-app) with Google and then use these credentials with MailMate using the `MmGmailOAuth2ClientID` and `MmGmailOAuth2ClientSecret` hidden preference values.
>
> There's a fourth solution described on the website, but I'd prefer if that one was not used and I'm leaving it out here.
>
> I've been using Gmail recently with an app specific password without any issues. I'm interested in knowing if the first solution above works for Google Workspace users. Well, I'm interested in knowing if an admin can find this setting. It would also be interesting to know if app passwords are allowed for Google Workspace users.
>
> -- 
> Benny


--
LATEXT: Literature, music and visuals / Littérature, musique et graphisme - www.latext.com
BETALOGUE: Blog - www.betalogue.com | Mastodon: @betalogue at toot.community
FAUX AMIS : Site sur les faux amis anglais-français - www.fauxamis.fr | Mastodon: @pierre_igot at mastodon.social