Feature Request: OAuth 2 authentication in IMAP&SMTP
Hello.
I am a relatively new user of mailbox.org who is tired of big corporations' surveillance. I find this service almost perfect for me, as it is in the middle point of having extreme (almost unusable) privacy and being like google in terms of privacy.
I have had some concerns about the two-factor authentication feature on mailbox.org, but I have switched to here from google anyway since there is a "Login 2.0 Beta" feature now. But when I learned that I have to set up my mail client with "Normal Password" credentials without 2FA whatsoever, I thought mailbox.org has some unusual "security sense". It does not make sense to set up 2FA if someone can access my e-mails easily without the second factor: It kind of defeats the whole purpose.
There are many mail providers such as google and outlook that offer secure IMAP&SMTP setup with OAuth. So, this post suggests mailbox.org to have OAuth 2 authentication for (at least) private customers for IMAP, SMTP and other protocols. Such feature will allow users to:
- Login securely everywhere with their second factor, including their third-party applications.
- Track which applications have authorized to view emails, additionally get notified if there is a new application that is authorized.
- Use mailbox.org as a real secure mail provider.
I think having a secure authentication implementation is a must for mail providers these days. Almost every account on the internet is connected to an email and thus can be cracked if the mail provider could be. I'd love to hear from you if such implementation could be a reality in mailbox.org.
Kind regards,
MGVLoonydh
I like this idea 
I would also love to see this feature! Without this, real Passkey and OTP support is futile.
I would also love to see this feature! Without this, real Passkey and OTP support is futile.
This is an extremely important feature that Mailbox should consider.
This is an extremely important feature that Mailbox should consider.
Das würde ich ebenfalls sehr begrüßen. Oder besser noch: Eine Lösung als Integration direkt in DeutschlandGPT.
Danke!
Das würde ich ebenfalls sehr begrüßen. Oder besser noch: Eine Lösung als Integration direkt in DeutschlandGPT.
Danke!
I really enjoyed the features and user experience of Mailbox.org when testing it out. But the lack of oauth made me choose a different provider that I am less satisfied with.
Specifically I wanted to use Thunderbird as client from multiple different devices. I dont want to have to deal with rotating the access key on multiple devices.
I am sing custom domain so I will happily jump to Mailbox.org if oauth becomes available as a feature.
I really enjoyed the features and user experience of Mailbox.org when testing it out. But the lack of oauth made me choose a different provider that I am less satisfied with.
Specifically I wanted to use Thunderbird as client from multiple different devices. I dont want to have to deal with rotating the access key on multiple devices.
I am sing custom domain so I will happily jump to Mailbox.org if oauth becomes available as a feature.
I hope they decide to prioritise this. I was really happy with their product (primarily email) but I am not willing to compromise on security in this case :(
(Was supposed to be a reply to AutoDisc)
I hope they decide to prioritise this. I was really happy with their product (primarily email) but I am not willing to compromise on security in this case :(
(Was supposed to be a reply to AutoDisc)
I had just purchased a standard yearly subscription, when I decided to link my mailbox to Thunderbird for Android. Only then did I find out that only app passwords are supported for external apps.
How, in this day and age, is it possible that a fundamental security feature like oauth is missing? Isn't security the single most important aspect an email provider should focus on, since all other online services rely on an e-mail address for communication and account recovery?
Once an email address is compromised, the rest will follow suit.
I already regret my purchase. Such a shame too, since mailbox.org offers rich and granular functionality compared to most other big competitors.
It would behoove the customer support staff to at least keep these threads up-to-date with the current internal developments made on the implementation of this feature. But, this thread is already almost two years old, and still I see no official responses. Even letting us know there's discussion about it internally would help out, but we're left guessing in the dark.
Considering all these factors, I can confidently say I won't be recommending mailbox.org to people I know.
Too bad, would have loved to see a European tech company make it big.
I had just purchased a standard yearly subscription, when I decided to link my mailbox to Thunderbird for Android. Only then did I find out that only app passwords are supported for external apps.
How, in this day and age, is it possible that a fundamental security feature like oauth is missing? Isn't security the single most important aspect an email provider should focus on, since all other online services rely on an e-mail address for communication and account recovery?
Once an email address is compromised, the rest will follow suit.
I already regret my purchase. Such a shame too, since mailbox.org offers rich and granular functionality compared to most other big competitors.
It would behoove the customer support staff to at least keep these threads up-to-date with the current internal developments made on the implementation of this feature. But, this thread is already almost two years old, and still I see no official responses. Even letting us know there's discussion about it internally would help out, but we're left guessing in the dark.
Considering all these factors, I can confidently say I won't be recommending mailbox.org to people I know.
Too bad, would have loved to see a European tech company make it big.
Replies have been locked on this page!