Bypass Google Security Protections for "less secure app" login

31/03/2021 - Ted

Since July 15 2014, Google have by default disabled access by "less secure apps" to things like IMAPS.

This means running something like mbsync or getmail which only uses PLAIN or LOGIN AUTH is declared a "less secure app" and will put you into a loop of being told to log into your account via a web page to confirm the login attempt was you, force doing a very secure confirmation that it IS you, and then just throw the same damn error again.

There are a few steps that MUST be taken to enable your less secure app to get in, but there is also a secret squirrel step to push through the last barriers.

1. Turn on IMAP/POP3
  1. On your computer, open Gmail.
  2. In the top right, click Settings Settings and then See all settings.
  3. Click the Forwarding and POP/IMAP tab.
  4. In the "IMAP access" section, select Enable IMAP.
  5. Click Save Changes.

Note: To avoid temporarily locking yourself out of your account, make sure you don't exceed 2500 MB per day for IMAP downloads and 500 MB per day for IMAP uploads.

2. Allow less secure apps: ON
Try logging and going directly to this link: https://myaccount.google.com/lesssecureapps
If it has moved, try searching for "less secure apps google" or heading here https://support.google.com/accounts/answer/6010255?hl=en
3. Trial out connecting
You should now at least possibly be able to authenticate with your account. Changes of this working at this stage are exceptionally unlikely.
You're far more likely to end up with the following looking error happening, which is a signal that you need to log into your account and acknowledge all of the security incident activities as "It was me!".
4. Review security incidents
Need to acknowledge all of the security incidents including both turning on insecure mode and the attempt of the "less secure app" to access.

Just head to the massive link to end up in the correct location. In theory, you should now be able to authenticate just fine.

Warning from IMAP server: [WEBALERT https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=XXgnsbsVbNcuD3vlR89dvDskn9XXXX4c0RrWKj3SrkFLPJyWUix3sytH1VatywmjVFJNUPdyN2RISn82WyfT-A3wM8WfTWCZiPjgrB6TAN6dEzvsWpsnbjXXXXnMr-6BjXXXXROT4KZXB] Web login required.
IMAP command 'AUTHENTICATE PLAIN ' returned an error: NO [ALERT] Please log in via your web browser: https://support.google.com/mail/accounts/answer/78754 (Failure)
*** IMAP ALERT *** Please log in via your web browser: https://support.google.com/mail/accounts/answer/78754 (Failure)

Ha! Right. Anyway, time for the magic step.

5. Super Secret Squirrel Step
You need to "unlock" your account for any device using any method to access your account. At least temporarily I hope.
  • Head to https://accounts.google.com/DisplayUnlockCaptcha and click "Continue"
  • or search for "unlockcaptcha" and do the same as above.

You can now try to connect to IMAP using the "less secure app" and it should no longer have an issue.

Tags: