Ralph Fox wrote:
On 8 Sep 2018 15:24:24 GMT, Frank Slootweg wrote:

If someone wants to POP their Gmail, use a Google app password with
the POP account. A Google app password also meets Gmail's requirements
for not being "less secure".

How do I do that? I don't know what "a Google app password" is (in
this context) and hence not how/where to set one.


A Google "app password" is a 16-character code where
* Google generates the "app password"code for a specific program
(e.g. Thunderbird). You would have a separate "app password"
code for each different program.
* You will get Thunderbird to save the "app password" just like
it can save a normal password. (In Thunderbird, set
'Authentication to "Normal password".
* You can invalidate an app password without having to change your
Google password (for example, if you lose a device).
You manage your app passwords from your Google account's "app
passwords" page.


Here is how I created an "app password" last year...

1) To create an "app password", you first need to turn on
"2-Step verification" in your Google Account Settings.
If you don't want 2-step verification, you can turn
it off again after you have created the app password.

2) Next, to create the Google "app password" go here and
follow the instructions
https://security.google.com/settings/security/apppasswords

If you don't see the option to *create* an app password,
then "2-Step verification" still needs to be turned on.

3) The app password is a 16-character code which you will use in
Thunderbird (and only in Thunderbird) in place of your Google
Gmail POP3 account password. You set authentication to
"Normal password" and still put your Google username in the
"User Name" field.


An app password gives you two advantages
1. You can turn off "allow less secure apps";
2. You can invalidate an app password without having to re-enter
your Google password in every program which uses it.


The problem for Google is that too many people have weak passwords
like "Mary123", and/or they use the same password more than one account
(yes, Google does have to deal with many people who are not like
VanguardLH :-) ). An app password ensures those people have strong
passwords which are not re-used across different accounts.

Also if someone loses a device they may be reluctant to change their
Google password as this means updating the password on multiple devices.
An app password can be revoked without needing to change your main
Google password on multiple devices.

Thanks, Ralph and VanguardLH! Very clear!

I'll save this for the next time Google will be bothering me again
with its false security warnings, probably when we'll use ('free') Wi-Fi
hotspots [1] on our next trip in Australia.

[1] Yet another reason for trying to avoid Wi-Fi hotspots and just use a
personal mobile-data hotspot instead.