yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] prime3sdro:
I am using one time configure and forget app passwords to connect to my gmail account. It does not need to go to refresh token procedures every time. I have not register for google account in mobile.

Why do not you suggest in your app during configuration? Have a link above during gmail configuration above passoword

Configuration Page

..

Generate app password for you account <link to app password>

Learn more about app password <support.google.com/accounts/answer/185833>

[Password box]

..

Anyway the FairEmail is just about email only.
[Android Apps and Games] M66B:
Since the F-Droid version is built irregularly, which can be problematic if there is a critical issue, the GitHub version is advised. Please see also this FAQ:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq147

The GitHub version will notify you when there is an update. You can configure the check frequency in the miscellaneous settings of the app.
[Android Apps and Games] M66B:
If the app only supported app passwords, there would be lots of 1 star rating in the Play store because many people experience this as too difficult. They are used to one click setups.

Moreover, there is already a remark "I want to authorize an account with a password instead of an on-device account", which will lead here:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq6
[Android Apps and Games] M66B:
@prime3sdro just now there was a 1 star rating from somebody who don't want to use an on-device account and says that an app password is too complicated. Probably, the app wasn't updated yet because the web OAuth flow is available for everybody now.
[Android Apps and Games] M66B:
The token grant rate seems to have stabilized around the limit of 60,000 tokens/day. Previously this was around 37,000/day. This probably means that there were 23,000 / 24 ~ 950 new Gmail accounts configured (assuming the graph shows access tokens). Since there were a number of French articles about FairEmail recently and there are about 67 million people living in France, this seems a good explanation for new accounts to me.

To prevent 1 star ratings and to keep existing accounts working, I have no other choice than keeping the app invisible for new users at this moment (unpublished in the Play store developer console).

I want to see the token grant rate limit be raised significantly because it is ridiculous that there can't be even 1,000 new users without causing problems for all Gmail accounts. As said before this is in my opinion abusive behavior according to EU Article 102. Things like this make projects like this infeasible for more than a few users.
[Android Apps and Games] mkasimd:
Now I also understand why the rclone project says that users should generate their own G-Drive API key instead of using the API provided by the software itself whenever possible. Sadly, that same approach won't work with FairEmail as FE is a general purpose email app used by all kinds of people.

Complaining about something being illegal doesn't help as well. I am fighting against Telefonica Germany right now because since February, I had 1 - 2 weeks per month either absolutely no cellular connection or purely 2G while I pay for their unlimited 5G data plan. They won't even let me cancel the contract wherein they obviously don't provide me the service I pay for. This too is a violation to several national laws - especially as they ignored my extraordinary cancellation request and processed it as if it were an ordinary cancellation request.

Unless you pay up a lawyer and go to a court, they won't care. They also know that this is a financial and mental barrier most people won't take. So, they can keep up their BS. It's no different in your case with Google.

Maybe it isn't how they intended things as Timmaaah said. Maybe it was the intention from day zero. We simply don't know. But I can tell you that companies do exist, that act unlawful intendedly. A company I worked for (not giving any names) for instance stated internally: we know this is a clear violation to the GDPR, but we will still add all customers to our newsletter without asking them first. We don't expect anyone to go to the courts, they will click the "unsubscribe" button instead, or they won't and we will have more recipients from day zero.

Some companies do evil knowingly. Others unknowingly. But luckily, there are also enough companies and people that take their user's voice serious and reflect on their behavior (mostly SMBs). Unfortunately, Google is one of the prior two and not the latter type. A company I would rather not have any business with unless absolutely necessary. I even ditched my plans on Amazon AWS in favor of a local provider in the Netherlands for similar reasons.

Unfortunately, you cannot just ditch Google as Google is a major player on both Android as well as the email industry... I wish there was a law prohibiting any phone vendor to lock in their users to their own email infrastructure to access any services necessary for the intended and proper use of the phone as well as any pre-installed app (such as the Play Store and Play Services). If so, Gmail would be just another random email service provider today. No better than Hotmail haha
[Android Apps and Games] M66B:
Both complaining and going to court obviously won't help for an app which needs to work now. The intention is more to create awareness about what is happening.

The only thing I can do is try to contact Google to get the limit raised. The result might be unsatisfactory in the end, which might result in the app not returning in the Play store. Practically, this would mean the end of the project because about 98-99% of the app installations are via the Play store.

I am not giving up yet, but I can't force Google.

The information here has been updated:

FairEmail in the Play Store

Status and frequently asked questions

faircode.eu
[Android Apps and Games] M66B:
I've looked up the last request for raising the Gmail OAuth token grant limit.

Requested on: June 18, 2021

Requested limit: 1,000,000 tokens/day

Granted on: July 16, 2021

Granted limit: 40,000 tokens/day (raised by 20,000 ~ 800 Gmail accounts)

If this happens in the same way again, the app will be unavailable via the Play store for a month and configuring Gmail accounts will be problematic for a month. I think this is unacceptable.

What I think is a realistic limit is 500,000 app installs x 50% Gmail accounts x 24 hours = 6,000,000 tokens/day.
[Android Apps and Games] M66B:
I have a theory about how the token grant graph/limit works. Access tokens will always be issued, independent of the limit, but they will be counted and if the limit is being exceeded, new refresh tokens will be rejected. This would mean that existing accounts keep working (access tokens), but that new accounts can't be configured (refresh tokens).
[Android Apps and Games] O_DoC:
Hello,

Just to share peacefully but honestly my thoughts :

FE is far beyond the best android email app around.

It's been years that everything works great.

People who want gmail, could already use either android account Oauth or app password.

The fact that in the last few days g2ogle 'magically' open the door for web Oauth, without the security 75k/y audit, is a plus ''ok''. (Also with 'traps', unfortunately...but with them it's kind obvious part of package too)

So, if the web Oauth is not working as expected, yet, there's still the two 'legacy' ways to connect one's gmail.

Maybe / surely I don't get it all, but :

Why this, lastly added optional third party/way process, could threatened our beloved FE very existence ?

Do people wipe their brain and forget the fact that f@%# already worked flawlessly ?

Really don't get it : (

-

Also, and more importantly, take care of yourself and your family!

That's should be your one and only things.

Take care
[Android Apps and Games] M66B:
I don't think the web OAuth flow is the problem, else the problem would be worse by now, given that this feature is available for everybody now. It is "just" a way to do the same thing in another way.

My best guess is that French people configured "many" Gmail accounts as a result of a number of articles. The fact that the peak was at about 88,000 tokens/day and that this decreases to about 60,000 tokens/day now supports this theory. This says that about half of the people who tried the app uninstalled it again.

So, this could have happened every day.

Google's policies are the real culprit.
[Android Apps and Games] O_DoC:
Agreed with you.

When I said 'issue with web Oauth', it was versus 'android account Oauth', by the fact that in one case there's a limit (even if this is unilateraly not ok politic to...but anyway) and the other there's no limit.

So if for some odd reason they hardly limit by ''forgot to count correctly'' the token type and number.

There's still the ''old good way'' with app password and android account.

People deals with it for years and there's no issues.

You want a gmail account - ok

1. Android account

2. App password

3. Maybe when situation cool down, web oauth

And people who said ''don't want give phone number'', you're using g2ogle...come on... (and there's burner number for one time process and then setup a otp app or hardware key, etc.)

Again this is just 'from my window' so I could lack of information to correctly assess the situation.
[Android Apps and Games] M66B:
Unfortunately, it is more like:

Android account WTF

App password WTF

One star

Reviews of today are a testimony of this.

The web OAuth flow is there to prevent point 3 and to allow using for example business accounts without configuring these on a personal device.

Tokens acquired via the Android account manager or tokens acquired directly by the app are not different. In the end the same Google OAuth server will be used.
[Android Apps and Games] O_DoC:
Like usual, we all know where the source of ''don't be evil''.

Maybe, if someone with audience, could publish an article (blog or else) to put some light on this ''token count formula mistake'', there's more chance they'll adjust it.

And for the ''wtf'' people, I maid my mind longtime ago, it's a bottomless hole.

Human as an.individual, could be amaxing, but as a group...well...
[Android Apps and Games] M66B:
I am planning to file a complaint via here:

Reporting anti-competitive behaviour - Your Europe

European rules on how to report anti-competitive behaviour, who you should contact and how to claim compensation.

europa.eu

So far I have written this email:

Suggestions are very welcome!
[Android Apps and Games] sfhub:
Whether one is using Google Account OAuth or web OAuth, the same # of OAuth access tokens will be requested and issued, the difference is the login method.

There was a small chance they were being counted differently but since there is a plausible explanation for the magnitude of the access token usage spike (ie an increase in FairEmail users corresponding to some French news articles about FairEmail along with increased google play download rate) that is looking less likely.

Given the above, with the 60k access token limit of which around 38k were already being used, FairEmail apparently only had the ability to support 915 more concurrent Gmail users (google account OAuth) even before web OAuth flow was added. The web OAuth feature addition happened coincindentally at roughly the same time as the French articles about FairEmail so it appeared web OAuth was the cause of the token usage spike when it is more likely just the addition of more FairEmail users configured for Gmail using either Google Account or web OAuth.
[Android Apps and Games] M66B:
I have updated the token grant rate graph and it still isn't looking good:

FairEmail in the Play Store

Status and frequently asked questions

email.faircode.eu

The number of purchases via the Play store has dropped significantly, which isn't a problem for me, but it could be for a company. This illustrates the anti-competitive aspect of an artificial limit on the token grant rate.

I say artificial because all tokens are related to a Google account and if there is any misuse, the account should be blocked and not the tokens, affecting all users (and the developer).

I will wait with filing a complaint with the EU because I don't want this to be in the way for a token grant limit raise now, but IMHO this is clearly anti-competitive behavior under the guise of security.
[Android Apps and Games] GalaxyA325G:
Update on OAuth2 on Android after May30th, 2022...

1. I don't have a Google Mothership Tracking Account on my unrooted Android phone, and I never will.

2. Hence, I could never use the Google GMail app to log into my Google email account because it CREATES that mothership tracking account.

3. Therefore, I moved to a third-party MUA which worked fine for me for years UNTIL May 30th 2022 when Google unilaterally stopped supporting login/password, as the respected developer of Fair Mail is well aware of.

4. I don't want to use 2SV/2FA/MSV/MFA because of the inherent loss of privacy involved, although I was advised by the kind-hearted good natured developer of Fair Mail that it was perhaps the only option left (e.g., andOTP, FreeOTP, or similar).

5. Since early March when Google warned me about their deprecation of login/password, I've been desperately looking for an Android 3rd-party MUA which can log into a Google account WITHOUT 2FA/2SV/MFA/MSV and without creating a mothership tracking account on the phone - and - to his inestimable credit - the Fair Mail developer kindly explained why Google requires that Fair Mail require that mothership tracking account (in order to perform the OAuth2 authorization, which isn't done via the web due to the cost required for the annual security audits required by Google for that feature to exist in Fair Mail).

6. This week, I was advised that the K-9 Mail version 6.201 does that all important OAuth2 over the web. I tested it just now. It works.

Note that they probably have resources the kind-hearted good-natured Fair Mail developer lacks, in that they teamed up with Thunderbird.
[Android Apps and Games] M66B:
7. The author of K9 mail helped to add this to FairEmail too. Please update to the latest version.
[Android Apps and Games] M66B:
The next version will have optionally VirusTotal integration, so you can check attachments easily:
[Android Apps and Games] Timmmmaaahh!:
Very much in support of this! Excellent write-up. One minor correction would be "...and

have

developed...". Perhaps you could also add: "For this reason

and due to a number of sophistic reasons imposed by Google

I was forced to remove...", which would hint at the "privacy violation" that was abused in the past by Google to expel FE from the Play Store.

Sorry if I missed this but do the non-Play Store FE versions have this token limitation as well?
[Android Apps and Games] M66B:
Thanks for the suggestions.

All versions of FairEmail will suffer from the token grant rate limit, although OAuth is available in official builds only (Play store and GitHub) and notably not in the F-Droid version. Related FAQ:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq111
[Android Apps and Games] Timmmmaaahh!:
But PS and GH OAuth numbers don't accumulate, right? As they are two separate packages.
[Android Apps and Games] M66B:
The package (name) and the digital signature are the same for the Play store and GitHub version, which is also a requirement because else acquiring tokens via the Android account manager wouldn't work.

The contents of the APK file are a bit different though, which is being explained here:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq173

In addition: getting approval for OAuth is already hard enough for one package (app). For example getting approval from Verizon (Yahoo!) took months (and also signing a contract, which is one of the reasons why OAuth is available in my builds only because there is only permission for me).
[Android Apps and Games] chris122380:
I do not like K9 it's not advanced enough and looks too old school. It lacks many of the essential emails features. This is exactly why I use Fairemail. I have been paying attention to the Thunderbird acquisition of K9 and many of those who use email on Android are asking them for Fairemail features and in many cases there are complaints that Thunderbird should have actually acquisitioned with a more mature email client AKA Fairemail.
[Android Apps and Games] chris122380:
If you would bother to read the Play Store change logs (or this forum you posted in) you would have seen the recent changes with Fairemail and OAuth. If privacy really is your concern then K-9 (and Gmail for that matter) is the wrong email app to use. K-9 lacks basic features including swipe gestures to delete an email. K-9 and many other email apps lack basic security features of blocking email trackers that Fairemail does quite well.
[Android Apps and Games] M66B:
Mozilla didn't contact me about this, so the possibility was never explored.
[Android Apps and Games] chris122380:
That's disappointing considering the fact that you have a much better and more mature app. No worries here I'm not leaving Fairemail anytime soon. If mozilla's history of Thunderbird speaks for the future of K-9 then it will be 20+ years before it even puts a dent in the features currently found in Fairemail never mind to say how more advanced Fairemail will be then. It's been over 10 years and they still can't get proper calendar and contact sync for Gmail in their desktop app.

The only reason I thought it would be nice if Thunderbird (or any open source organization) took over Fairemail, is so we don't have to worry about the death of the project if something happens to you as the main developer. It was already scary enough to know we could have lost the project earlier this year.
[Android Apps and Games] nadir husain:
There is actually no comparison. If memory serves k9 was developed around 2011 , perhaps sooner. FE started being developed in 2018. K9 was ignored for a lot of it's life and only recently one of the developers( originally there were 2) rediscovered his youth and decided to start working on it again, while Marcel has literally devoted his life to his baby FE. I don't think k9 will ever be at par or even close to FE. Comparing the two would be like comparing a Ferrari(perhaps Marcel likes another car make) to a bicycle,!
[Android Apps and Games] mkasimd:
I always thought the Dutch preferred their bicycles back, though. That's what they always tell me when I am in the Netherlands xD [1]

Jokes aside, I have a few suggestions for your complaint about the antitrust act, @M66B:

Even if you are not trying to make bucks off FE, FairCode B.V. is still a company. So you should include that you're losing potential buyers and thus risking your business

Tell them about how many users 60k tokens mean (the calculation from before)

Tell them that this hinders your growth

Tell them about the French articles (including a few links), the resulting spike in token generation resulting in the available amount of tokens being depleted

Point 4 resulted in increase of 1* reviews that could impact your app's position in the app store

People who couldn't add their GMail account possibly just deleted the app, because out of their perspective it didn't work -> lost sales opportunities

You as a developer was forced to remove the app from the Play Store to avoid more disappointed new users as well as 1* reviews -> lost sales opportunities

Sure, one could infer those points from your website. But trust me, when you contact an authority or a court to send a complaint, you need to write the specifics in the letter and not just point to a website. Pointing to a website can only be an addition, not a replacement to the in-depth explanation of the factual situation.

[1] for those who don't get that, it's basically a friendly post WW II joke with which the Kaaskops try to annoy us Germans, so just trying to lighten the mood after all Marcel's been through 😉
[Android Apps and Games] GalaxyA325G:
OMG! That's fantastic!

Thank you for kindly and quickly letting me know you recently added web-based OAUth2 (as I remember you saying you didn't have the money (perfectly understandably) for the annual security audit) - so it didn't even occur to me to look again - at least not after you told me that there was no other solution only a short while ago.

Looking backward in this thread, I see, apparently, Google loosened the requirement for the annual $15K-$75K security audits (is that correct?).

Mea culpa.

I apologize for missing that all-important detail as I was sure you WANTED to allow OAUth2 over the web, but I had thought (understandably so) that the annual security audit was the obstacle to implementation.

To be clear, my goals are simply as a mere user who cares about privacy to use the best tools out there, which, at the moment means...

a. A good 3rd-party MUA

b. That performs Google email authentication

c. WITHOUT trading privacy for security (e.g., without 2SV/2FV)

My basic stance is...

A. I'm not rooted nor am I a developer (I'm just an Android user)

B. I will never add a mothership tracking account to my device

C. And I dislike 2FA/2SV (for reasons of trading privacy for security)

Notice "app passwords" REQUIRES 2SV/2FA <== important point!

To always be blunt with you, so that you know I care about your product, here are the screenshots I posted to the Android, Windows & Thunderbird newsgroups on Usenet way back in March (comp.mobile.android, alt.comp.os.windows-10, alt.comp.software.thunderbird) showing I used your Fair Mail product then...

BTW, I'd LOVE to know HOW you were able to circumvent the annual security audit (in only the highest terms, of course, private message ok), which, based on what I gleaned from how K-9 may have done it, came about via clever use of whatever code that Christian Ketterer (aka cketti) put into his Office 365 OAUth2 solution.

NOTE: Those illustrative screenshots below were taken back in March & posted at that time to the Android, Thunderbird and Windows 10 Usenet newsgroups, which - at that time - was well before I found out all the trouble Google unilaterally put you through to get OAuth2 to work for us on Android without creating an on-device mothership tracking account on the phone.
[Android Apps and Games] loyl1:
Hey Marcel,

Hope you've been well. Love seeing all the new features.

I was reading an old article about the possibility of DANE being able to encrypt all email. Has that gone anywhere? That would be pretty cool, but I'm sure it's complicated, even implementing features like search.

Is there research currently happening along those lines?

Peace to you,

Tom