IMAP: Gmail sunsetting less-secure passwords

[r-a-y]

I was just made aware that G Suite (the enterprise arm for Google Apps) is going to start pushing the use of OAuth for authentication.

This affects RBE users that are using IMAP mode with GMail via G Suite. I believe if you're already using an app password to authenticate, that you will be okay. But if you're authenticating using your regular Gmail password or the less-secure app approach, you will need to switch over to app passwords by sometime next year (this also requires Two-Step Verification enabled).

As for regular, consumer GMail users, it's not clear what Google will do. But I believe the push for OAuth is only specific to G Suite users at this time. Update - this also affects regular GMail users as of June 2022.

Similarly, Microsoft's Office 365 is also moving forward with OAuth as well. This would affect those using Outlook with an Office 365 account.

---

The alternative would be to support OAuth authentication for IMAP. For this to occur, it would either mean integrating a 3rd-party PHP IMAP library (see google/gmail-oauth2-tools#18) or wait for PHP's native IMAP to catch up (currently, RBE uses PHP's native IMAP functionality to authenticate). For the former, this will add a dependency on another library. For the latter, this will probably take awhile to implement and might not be available for older versions of PHP. Both approaches will take up developer time.

The alternative for site owners would be to switch from RBE's IMAP mode to Inbound Mode as well.