Gary, There is not doubt in my mind that 2FA is the way forward. I think you need a different token than your cell phone, such as the Yubi key. Here is an article on Yubikey and Google. "In 2009 Google was the target of sophisticated cyber attacks capable of circumventing traditional security controls. With a lack of viable two-factor authentication (2FA) options to effectively prevent these attacks and account takeovers, Google began working closely with Yubico to extend the capabilities of the YubiKey two factor authentication technology to also include public key cryptography." https://www.yubico.com/resources/reference-customers/google/ You can generate an application password for Google. https://myaccount.google.com/apppasswords Some other settings Gmail SMTP server address: smtp.gmail.com Gmail SMTP name: Your full name Gmail SMTP username: Your full Gmail address (e.g. you(a)gmail.com) Gmail SMTP password: The password that you use to log in to Gmail Gmail SMTP port (TLS): 587 Gmail SMTP port (SSL): 465 Requires SSL: Yes Requires TLS: Yes Requires authentication / Use authentication: Yes Requires secure connection / Use secure connection: Yes Brian On Sun, Mar 19, 2023 at 10:00:02AM -0700, Gary wrote: -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

I was just giving details for relaying through Google smtp server. I guess you are relaying through someone else? On Mon, Mar 20, 2023 at 06:28:08AM -0700, Chris Miller wrote: -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

On Tue, Mar 21, 2023 at 09:55:26AM -0700, Chris Miller wrote: I am not using the gmail smtp. Yet, it appears that you have to create an app password and use that as the password for your smtp auth. You certainly wouldn't want to use your regular password that you log into your gmail account with. I use an app password for committing to github. I use the same user name, yet I use a generated password to do commits. That way, it only has certain access. Did you try creating an app password and using it? -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

On Mon, Mar 20, 2023 at 06:28:08AM -0700, Chris Miller wrote: The two lines above I would imagine. -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

Anything that makes a task more difficult, makes it more secure. The question always is, is the extra effort "worth it". The Yubikey seems to be a hard token. I've used them. They are a pain. Orginally, at this point, I wrote a bunch about attack vectors and on and on. But the bottom line is that I'm not willing to go through 2FA to access my Gmail account remotely, so I don't use it. It's not "worth it." They've gone too far. I don't like a lot of the things my Google account gets used for. And, I don't want to turn my phone into a security device of any kind and no, I won't install an app on my phone to access your service. I don't have a choice with Gmail. That is making it hard to deal with some institutions. So I caved and set up a second phone. But I'm also questioning whether I rely on, or am exposed to, the internet too much.. An issue is that the banks, whatever, seem to have a poor understanding of what the threat is. Golden1 once, not that long ago, sent me a legitimate email that looked exactly like a phishing scam. I sent them an email referencing their initial correspondence and that, no , I wouldn't respond that way. And at least for awhile, they included instruction on how to reply after logging in. The social attacks are still working. I've never spoken to anyone who knows of a reasonable userid/password being brute forced. Guessing that the password is "password" counts as a socail attack in my book. So we pile on armor in places where the attack never succeeds and leave ourselves bare where it does. -Gary On Mon, Mar 20, 2023 at 12:16:19AM -0700, Brian E. Lavender wrote: