有时候，当你在寻找一件事的答案时，你最终会发现另一件相当令人惊讶的事情。举个例子，谷歌声称Mozilla Thunderbird不太安全，但他们为什么这么说？今天的超级用户问答帖子回答了一个困惑读者的问题。

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

问题

超级用户读者Nemo想知道为什么谷歌认为Thunderbird不那么安全：

I have never had problems using Gmail with Thunderbird, but while trying to use a free software client for Google Talk/Chat/Hangout I discovered the following unexpected statement. According to Google’s document on Less Secure Apps:

• Some examples of apps that do not support the latest security standards include […] Desktop mail clients like Microsoft Outlook and Mozilla Thunderbird.

Google then offers an all-or-nothing secure vs. non secure account switch (“Allow less secure apps”).

Why does Google say Thunderbird does not support the latest security standards? Is Google trying to say that standard protocols like IMAP, SMTP and POP3 are less secure ways to access a mailbox? Are they trying to say that the activities users engage in with the software puts their accounts at risk or what?

Secunia’s Vulnerability Report on Mozilla Thunderbird 24.x says:

• Unpatched 11 percent (1 of 9 Secunia advisories) […] The most severe unpatched Secunia advisory affecting Mozilla Thunderbird 24.x, with all vendor patches applied, is rated highly critical (apparently SA59803).

为什么谷歌说Mozilla Thunderbird不那么安全？

答案

超级用户贡献者Techie007为我们提供了答案：

It is because those clients (currently) do not support OAuth 2.0. According to Google:

• Beginning in the second half of 2014, we will start gradually increasing the security checks performed when users log into Google. These additional checks will ensure that only the intended user has access to their account, whether through a browser, device, or application. These changes will affect any application that sends a user name and/or password to Google.
• To better protect your users, we recommend you upgrade all of your applicati*** to OAuth 2.0. If you choose not to do so, your users will be required to take extra steps in order to keep accessing your applicati***.
• In summary, if your application currently uses plain passwords to authenticate to Google, we strongly encourage you to minimize user disruption by switching to OAuth 2.0.

Source: New Security Measures Will Affect Older (non-OAuth 2.0) Applicati*** (Google Online Security Blog)

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。