<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">Hi Matt,</div><div dir="ltr"><br></div><div dir="ltr">for larger providers I think we should reach out, this is something the council can do. For smaller providers, I doubt the secret will be exposed to the customers. Therefore I'm not sure how useful it would be to expose this in the UI. Having something in about:config or even exposed through the MailExtensions API seems reasonable to me.</div><div dir="ltr"><br></div><div dir="ltr">Instead of having this in the source I'm wondering if we should instead deliver the secrets vis RemoteSettings. This way we can easily update keys as necessary without an extra release.</div><div dir="ltr"><br></div><div dir="ltr">Philipp </div><div dir="ltr"><br><blockquote type="cite">On 22. Sep 2019, at 6:25 AM, Matt Harris <unicorn.consulting@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<font face="Calibri">It is obvious from recent SUMO posts that ATT
is pushing oAuth for their customers. Probably at the behest of
Yahoo. However ATT have no oAuth secret. So I am posting to tb
planning looking for feedback on how we deal with the insidious
oAuth contracts. It has been out there for years that <a moz-do-not-send="true" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1293958#c25">Frontier
intend to withdraw other connection methods</a>. It has also
come to my notice recently that we simply do not support oAuth for
POP accounts at all.<br>
<br>
So it is time for a coherent decision. Do we just leave these
users out in the cold, reach out to the parties concerned asking
for their non existent secrets, or do we modify the account
manager to allow the selection of a pre existing secret.
Thunderbird offers a list of providers whose keys Thunderbird has
and let user input what ever they like in the field. So BT, ATT,
Verizon and Yahoo can set the oAuth key to Yahoo.<br>
<br>
I claim no knowledge of oAuth, but it is a reality and we need to
have some sort of policy on how this is to be done going forward.
The existing process of needing to create a separate arrangement
for </font><font face="Calibri"><font face="Calibri">BT, ATT,
Verizon and Yahoo is going to become labour intensive and always
out of date.<br>
<br>
Given dovecote is offering oAuth as an authentication method
means that oAuth will most likely become more common over time
with small providers. So what is it to be? how do we manage
this?<br>
<br>
Matt<br>
</font><br>
</font>
<div class="moz-signature">-- <br>
“Against stupidity the gods themselves contend in vain.”
<i>― Friedrich von Schiller, Die Jungfrau von Orleans </i></div>
<span>_______________________________________________</span><br><span>tb-planning mailing list</span><br><span>tb-planning@mozilla.org</span><br><span>https://mail.mozilla.org/listinfo/tb-planning</span><br></div></blockquote></body></html>