yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] GalaxyA325G:
Just moments ago I asked on the Windows, Android & Thunderbird Usenet newsgroups today whether OTHER 3rd-party MUAs are limited by this puny amount of OAUth2 tokens.

I don't know how to help Marcel, but I will add that not only is this low OAUth2-token limit seemingly blatant anti-competitive behavior by Google, but it also is another attack on personal privacy (which the EU should also care about).

For reasons why I claim that it appears Google is also attacking privacy by limiting the number of OAUth2 tokens, see ALL my prior posts, which are always about privacy (e.g., trading privacy for security with 2FV/2SV).
[Android Apps and Games] famusc:
The problem is that reviews are now like twitter, and everyone can say everything he wants as it happens on socials, even if he doesn't understand the object of what he is writing about.

FairEmail is a great product but it's too elevated for play store: most of people don't go further than initial setup.

So, pop it away from playstore, as you already did.

There's no point to do something that frustrates you.

You work on your projects because you like it, right? Then you should do what you like.

Byebye playstore and byebye useless reviews. I understand that you can't ignore those reviews. It happens: you don't want to but you see only those ones. There's nothing to do. The various "don't care"s are useless. So, in my opinion, leave playstore: it has already been too long that it saddens you.

Who likes your work already knows how to keep in touch with it and you. This is your community: everyone who likes FairEmail landed on this thread at least once. And probably updates the app from github since then. It's not perfect here, sure, but noone is complaining for app passwords, at least.
[Android Apps and Games] de_Wolf:
I did not do that from my point of view/thoughts. Everyone must be able to live from something, also you :-)
[Android Apps and Games] nujackk:
Hey trying to follow along , don't think I went far enough back. But for those of us that have been using the app for a while Gmail oauth should still work correct?

And is the app password option still available should oauth stop working?

And Marcel By all means take care of your family. You can come back to this later IF You Want.
[Android Apps and Games] mkasimd:
For as long as the API key Marcel uses works and Google's rate limiting doesn't impact it, OAuth should keep working.

App passwords are fully independent from OAuth. They have been and will keep working regardless of OAuth. You just need to add your account as "other provider" in the wizard.
[Android Apps and Games] nujackk:
Great Thank you, plan to continue using this app for as long as possible.

I know K9 has been added Thunderbird/Mozilla but FairEmail more privacy friendly and only use Gmail for a few things. And to maintain limited Google access
[Android Apps and Games] nadir husain:
I am not worried! As long as Marcel is using the app it will be maintained and I hope it will always be updated on github
[Android Apps and Games] GalaxyA325G:
IMHO, Marcel is correct and the huge distinction might be even WORSE (in terms of privacy) than what Marcel said above (in terms of support).

It has been my sad experience that most people don't seem to comprehend there is a HUGE difference in privacy between using the GMail app (which REQUIRES an on-device account!) and simply logging into the Google imap/smtp/pop mail servers (which does NOT require an on-device account - in most situations).

Big difference!

Specifically...

1. Using the GMail MUA CREATES a mothership tracking account

2. Using the Fair Email privacy based MUA (OAuth) does not

IMHO, that's two different beasts in terms of privacy.

Anyone who equates them... in terms of privacy... is misled (IMHO).

(I have far more descriptive words for people who can't comprehend the difference in terms of privacy... but let's just leave it as it's not even close to accurate for anyone to equate obtaining mail from a Google mail server with putting a full-time Google Account on your phone.)

I, for one, have no Google Mothership Tracking Account set up on any of my non-rooted Android devices - which means I won't ever use the Google GMail app on those devices (because it CREATES that mothership-tracking account and it also unilaterally uploads your contacts (whether you want it to do so or not, the last time I had tested it).

But I have no problems (in terms of privacy) using the Google mail servers via a 3rd-party MUA, particularly via a privacy-based MUA such as Fair Email is intended to be.

Like most people do, I access the Google mail servers via a variety of ways, from logging into them via the local library computers over the web, for example, to using my PC via Thunderbird MUA for another, and on my iPad via the Google iOS GMail app, and on my Android via Fair Email... etc.

None of those methods creates a mothership tracking account on your computing device.

That's the difference that the people who equated these two things don't seem to comprehend (likely because they ALREADY have that mothership tracking account set up on their devices, for all I know).

For those who don't know the difference, this needs to be repeated!

1. Using the GMail app CREATES a mothership tracking account

2. Using the Fair Email privacy based MUA (OAuth) does not

Having made that huge distinction on privacy, I do have a (very minor) enhancement request of the folks here to come up with a way for Marcel to more easily distinguish for the average user between the first two choices in his latest wizard (as illustrated below).

I would guess that an uninformed Android user might be confused by the first two choices in the Fair Email setup wizard of:

a. Gmail (Android)

b. Gmail (OAuth)

Note that few of us would be confused but maybe a user who isn't aware of the difference between authorizing via an on-device account and web-based OAUth2 might be confused?

Unfortunately, I don't have better words for Marcel to use in the Wizard dialog above - but maybe someone else here can help out?

Would this be better or worse?

a. Gmail (On-device account)

b. Gmail (OAuth)
[Android Apps and Games] M66B:
I am considering to drop support for Redmi devices and remove them from the list of supported devices in the Play store. People lose their messages due to a hardware issue or software bug and blame the app each time. Just now their was a bad review again for this. So, basically this device isn't supportable because it is broken.

Edit: I will try to live with the bad reviews.
[Android Apps and Games] GalaxyA325G:
As far as I know, there is a HUGE limitation (in terms of privacy) to how Google insidiously implements what it calls "App passwords"...

As far as I know, the use of "App Passwords" REQUIRES a "second something" which is an invasion of your privacy (as I see it).

That "second something", as far as I know, is === 2SV/2FA.

While Apple will never let you turn off your 2FV/2SV once you turn it on, Google will... but... the instant you do that, it's my understanding your App Passwords setup instantly STOPS WORKING (based on tests in the Usenet Thunderbird, Android, and Windows newsgroups).

Please keep that in mind whenever someone suggests App Passwords because it's essentially telling people you have to ALSO give Google your privacy (which OAUth over the web does not do, as far as I know).
[Android Apps and Games] mkasimd:
Can you please explain me, why do you call it an invasion of privacy if you are able to use a third-party OTP app such as the open source non-Google FreeOTP and FreeOTP+ apps as the second factor?

I know using those OTP apps is possible because I am using FreeOTP+ myself. Among others for 2FA on my Gmail account.
[Android Apps and Games] mkasimd:
OTP stands for "one time password". They are commonly either time-based (TOTP) or hash-based (HOTP). You can find some general details in: https://en.wikipedia.org/wiki/One-time_password

The Google Authenticator app is pretty much an OTP app as well. But the same technique can be enabled by third party open source apps. Not only available in the Google Play Store, but also in e g. F-Droid, which can be called a non-Google alternative to Google Play Store, but for open source apps.

OTP requires a few information such as a shared secret, a hash algorithm and how many digits the one time password should have. Those information are shared via the QR code you scan when adding a new token within your OTP app. Based on those entries, the app generates a one time password once requested by the user. This process does not require contacting Google or anyone else. In fact, FreeOTP+ works offline as well.

Therefore, there are no privacy implications AFAIK.

As you can install FreeOTP / FreeOTP+ outside of Google Play Store (e.g. through F-Droid) and as it doesn't require the app or your phone to contact Google to generate the OTP once set up, I don't see why there should be some kind of a "Google mothership server" involved.
[Android Apps and Games] topcaser:
A well known German blogger wrote some news about the situation:

FairEmail: Entwickler hat wieder Probleme mit Google

Der Entwickler von FairEmail, einer kostenlosen Open-Source-Mail-App, hat wieder Probleme mit Google. Dieses Mal geht’s um die Anmeldung ...

stadt-bremerhaven.de

Marcel, is there something this community can do to rise the pressure on Google? For example complaining by Google pointing to the mentioned article. Maybe other people have further ideas...
[Android Apps and Games] nubla:
If I recall correctly, I think the problem is that enabling 2FA in Google's settings first requires entering a phone number before being given the option to select one of many other possible second factors.
[Android Apps and Games] sfhub:
Is this something you would consider?

1) adding an explicit disclaimer for Gmail wizard that the user needs to acknowledge to continue, saying Google has crippled FairEmail and limited the # of concurrent Gmail accounts to 2500. There is a high probability this wizard will fail. The most likely reason is you are hitting this limit that Google has imposed and refuses to change. The developer is at the mercy of Google. If you are not happy, please do not leave a 1 star review, use this link to lodge your complaint with Google.

2) equivalent error message upon OAuth token failure when provider is Google.
[Android Apps and Games] GalaxyA325G:
I am NOT an expert in this (I'm just a user who is impacted by Google's malevolent attack on privacy after May 30th, 2022) ... but that's my understanding also, which is why I said Google nefariously pretends there are more authorization options than there really are.

Please do correct me if I'm wrong, but, unfortunately, as far as I can tell, despite Google purposefully fooling people into believing there are more options, in reality there are only two options...

a. Authorize via a "second something" (which requires 2SV/2FV), or,

b. Authorize via web-OAUth

That's it.

And even that second option didn't exist until a few days ago.

That's why, up until very recently, I haven't been able to access email using Android 3rd-party MUAs since May 30th, and which is why I commend both Marcel Bokhorst (aka M66B) & Christian Ketterer (aka cketti) for working together on our behalf to implement web-OAuth (which doesn't require that "second something" in order to authenticate).

To be clear, like any good con artist, Google has fooled almost everyone, in that most people seem to "think" there are other methods (e.g., "App Passwords" or "OTP"), but (AFAICT), they all boil down to the same fundamental flaw that they require a "second something" like 2FA/2SV in order to work.

Turn off 2FA/2SV, and they instantly stop working (at least in the tests that were run on the related Usenet newsgroups over the past few months since Google deprecated login/password on May 30th).

Note: At least Google allows you to turn off 2FV/2SV; Apple does not (Google hasn't gotten to that gotcha stage yet).

Moving forward, the great news though is that Marcel (Fair Email) & Christian (K-9 Mail) recently implemented web-OAuth2, which is one way that Thunderbird on the PC has been authorizing Google mail accounts for quite a while.

With web-OAuth, you are no longer forced to provide Google with a privacy-reducing permanent 2FA/2SV "second something"... nor should you be forced to create a privacy-reducing permanent mothership tracking account on your device ... just to read your email.

Having said that, I do make one assumption that I'd like to ask Marcel about, which is what happens when a person who does NOT have a Google on-device account hits that first option in Fair Email titled "GMail (Android)"?

I suspect that first option then CREATES the on-device Google mothership tracking account on the device... but does it?

NOTE: I tested that first option of "GMail (Android)", but I stopped short of the last step as I didn't want Google to create a privacy-reducing mothership tracking account on my daily use phone.
[Android Apps and Games] Exmet:
Excuse me, good sir, but how have you avoided having a Google Mothership tracking account? Are you running Graphene/Calyx?
[Android Apps and Games] fasznyak:
you know that even if you don't have a google account but have google services installed (and use gmail SMTP/IMAP), google will still track you but anonymously? you'll get an anonymized tracking ID so your actions can be tracked nonetheless.

it's just you don't get to be an identified person (first), but your data (wifi scan, bluetooth scan, etc.) will get analyzed, your emails will get analyzed (unless you exclusively use GPG, but even then the headers are not encrypted), and ordered to cohorts. but over time, you can be sure you will be identified by knowing your habits.

the point is, don't give ANY data to google, even if it's anonymized. they thrive on it. rob braxman on odysee has a good amount of material about how to keep really private. the first rule is: use a DEGOOGLED android, and never give any data to google and big tech in general, if you are able to.
[Android Apps and Games] de_Wolf:
@M66B, what is the current token grant rate after two more days?
[Android Apps and Games] M66B:
This is still valid:

FairEmail in the Play Store

Status and frequently asked questions

email.faircode.eu
[Android Apps and Games] mithrial:
It's getting traction (in German): https://www.heise.de/news/FairEmail-Entwickler-hadert-mit-Googles-Limit-fuer-OAth-Token-7192574.html
[Android Apps and Games] M66B:
I have added a new FAQ:

How can I select how a link should be opened?
[Android Apps and Games] GalaxyA325G:
By the way you asked it, it seems you think an on-device Google Account is required for native Android to work, but it's not needed.

You bring up a good point though, which is that some people accidentally (unknowingly probably) set up their phones with an on-device Google Account without knowing that the phone works just fine without it.

In fact, I think that misunderstanding is why some people have said that it's the same thing to have a Google Account on the phone as it is to simply log into a Google mail server (which is just dead wrong in terms of the astoundingly huge difference in privacy).

Marcel knows there is a difference though, which is why Fair Email used to create that Google Account when he had to, but now, with the latest releases, Marcel has two options in Fair Email.

a. GMail (Android)

b. GMail (OAuth)

The first uses (and presumably CREATES) a Google Account on the phone (which is anathema to me), while the second does not.

To be honestly blunt, as I always am, I don't even know what Graphene/Calyx is.

I'm just a normal Android user.

My phone is a normal Android phone.

I got it for free from T-Mobile, so they still own (most of) it. :)

Because T-Mobile owns (most of) it, I can't root it yet.

But I don't even need to root it.

Yet, I have probably far more apps (about 750) installed than the average Android user - with the result that I don't think there is anything anyone else can do that I can't do - my point being my phone works just fine WITHOUT an on-device Google Account set up.

Since it's a Galaxy, it doesn't have a Samsung account either, and I even asked what I'm missing out on, and people told me nothing useful.

​

Is there any app in the Samsung Galaxy Store worth the login requirements?​

1. The reason I'm here, in this thread, is that Google deprecated privacy on May 30th, 2022 - which means Fair Email stopped working for me.

2. Google desperately wanted me to move to 2FA/2SV, but for reasons stated many times already, that trades your privacy for security (whether it's via app passords, OTA, phone numbers, or whatever).

3. Then Marcel kindly added account-OAUth using a Google Account, but that doesn't work for me either because that trades privacy for security.

4. Just this week, Marcel kindly added web-OAuth, and that does work for me as it doesn't require either 2SV/2FA or an on-device Google Account.

Thank God for people like Marcel who care about privacy!

BTW, if you make the mistake of using the Google GMail app, it will ALWAYS create a Google Account on your device!

That's WHY we need conscientiously written privacy-aware 3rd-party MUAs such as Fair Email is.

NOTE: I'm not exactly sure though what the privacy implications are for web-oauth - but at least they don't require 2SV/2FA to be set up with Google, nor does it require an on-device Google Account.
[Android Apps and Games] maybeme2:
This is way over my head.

If, as I did, you've already set up your Google account when setting up your phone, can you delete it? What will happen to installed apps you purchased through Google if you delete your Google account?
[Android Apps and Games] GalaxyA325G:
We should probably take this offline as it's straying from the point of this thread, which is that Fair Email allows us more privacy than other MUAs such as the GMail app (which is anathema in terms of privacy).

1. Fair Email is already designed for privacy

2. Fair Email allows multiple Google Accounts for example

3. Fair Email does NOT require an on-device Google Account

4. Fair Email does not link in GSF APIs (as far as I know)

5. Hell, Fair Email doesn't even require 2SV/2FA

(which trades privacy for security)

Fair Email is a win:win all around for privacy.

Don't do that. :)

Or, um, er, at least you should NOT have done that.

The latest Fair Email works just fine WITHOUT an on-device Google Account.

You could have simply pressed the SKIP button during initial setup of Android and Android would have set itself up just fine WITHOUT that on-device mothership tracking account.

Just as you did with initial setup for Windows 10 Home or Pro when it asked for a Microsoft Account. (As a related aside, you can skip it for iOS and it will still set itself up, but it won't be able to access any apps in the App Store, so if you want to download apps, which you do, then ONLY iOS requires a mothership tracking account - but Android can download all the apps you want from the Google Play Store repository WITHOUT an on-device Google Account).

I've been doing this for years on many Android phones (and on Windows computers).

Rest assured, both Windows 10 and Android work fine without a mothership tracking account - it's only iOS and now, more recently Windows 11 Home that are requiring a mothership tracking account.

But not Android (at least not yet).

Of course you can.

Just go to your Android Accounts section and wipe it out.

Fair Email works fine on my unrooted Android 12 phone, which has NEVER had an on-device Google Account (nor 2SV/2FV set up).

I don't know. I suspect nothing will happen if you paid for Fair Email.

However, you can ask Marcel that since he might know what happens when you purchase Fair Email using the APK (which you can download from GitHub) and then you delete your on-device Google Account.

I suspect nothing happens in that case but I'll let others answer that as I don't use the Google Play Store app to obtain my APKs (I use the Google Play repository, but not the Google Play Store app).
[Android Apps and Games] sfhub:
As a clarifiaction, that labeling is confusing. In both cases, FairEmail is using OAuth2 tokens to access Gmail. The difference is whether the tokens are retrieved via the Android account login pathway or via the web login pathway.

This clarification is NOT a comment on anything else.
[Android Apps and Games] loyl1:
Marcel,

Sorry for your troubles. You don't deserve this poor treatment from Google.

Peace to your spirit,

Tom
[Android Apps and Games] loyl1:
P

I'm glad you're making good progress on privacy. Please friend, find a new place to get your privacy information. Braxman talks a good game (I found him/watched his videos when I started my privacy journey). He says a lot of things that are just plain wrong. I would suggest https://www.privacyguides.org/, or make a matrix account with the element app and join the privacyguides room for good discussions.
[Android Apps and Games] mkasimd:
No, Google does not require a phone number. Entering a phone number is one of the available 3 options to enable 2FA.

The available options are:

on-device account (on-device security key)

phone number (even virtual DIDs should work)

security key (any FIDO U2F key works, see this article)

I have added a screenshot for a test account of mine below showig the available options. The only costy option here is using a security key as the costs range from around EUR 30 - 60 (one-time payment while you can use the security key on multiple accounts with multiple services and providers).

If buying a FIDO U2F key is not an option, one can also always:

get a virtual DID from companies such as callcentric.com, sipgate.de / sipgate.co.uk or satellite.me (sipgate & satellite require address verification, satellite is only available in Germany)

get a prepaid SIM (might require an ID-verification for activating the SIM depending on national laws)

find a phone booth, retrieve its phone number and enter it in your account. Do not forget to wear gloves and don't you dare let Google hear your voice as you listen to the verification code!

Jokes aside, there are that many options available to turn on 2FA. I just don't understand why some people complain about it - and if they distrust Google that much why they are using GMail at all. Maybe it's just me, but I just can't make any sense of it.

I'm not trying to be rude, but if none of the above options are okay for you, perhaps GMail is not the right email provider for you. In any case, even though I'm not a fan of Google, one must admit that Google is offering sufficiently enough methods for enabling 2FA and app-passwords for anyone to enable it without violating their privacy. Especially so as the security key option does not result in giving up your privacy.
[Android Apps and Games] GalaxyA325G:
Yup. I agree. Marcel has much more important stuff to take care of so WE should come up with better wording.

What do you suggest instead of:

a. Gmail (Android)

b. Gmail (OAuth)

Maybe this?

a. Gmail (via on-device account)

b. Gmail (via web oauth)

Or maybe this?

a. Gmail (device auth)

b. Gmail (web oauth)

Or perhaps?

a. Gmail (account authorization)

b. Gmail (web authorization)