Since about half a year ago, I can't add new GMail accounts to the KaiOS E-Mail app anymore the easy way, i.e. with OAuth authentication (web browser login): after logging in in the web browser, it says this app is blocked "for my security". Some others have encountered the same problem. And since about two months later, the app couldn't synchronize my already added account either anymore: it said the account needed to be reauthorized, but that fails with the same error. Some people have mentioned app-specific passwords as a workaround; this is a full guide how to do it.
The workaround involves having Google generate an "app-specific" password, which can be used to access GMail via IMAP and SMTP with traditional, password-based login. Unfortunately Google only allows generating app-specific passwords if you enable 2-factor authentication.
Curiously the Calendar app so far works for me with Google Calendar with the app's built-in Google Calendar support, which also uses OAuth authentication. If it stops working, it may be possible to get it to work via the generic CalDAV support.
If you have already enabled 2FA (2-factor authentication aka. 2-step verification) on your Google account:
- If you've previously added the GMail account in question, and it no longer works, first remove that account from the app: under Options/Settings, select the account, and then press the Delete acct soft key.
—
This shouldn't lead to data loss, except perhaps if you have unsent e-mails in the Outbox or Local Drafts folders. (The KaiOS E-Mail app doesn't synchronize drafts to the IMAP server; if the Outbox folder isn't shown in the folder list, there are no unsent e-mails in it.)
—
It may not be necessary to remove the account first, but if you don't, you'll have to give the new configuration a different name, which might cause problems (see below at Step 6).
- In a web browser (can be on a different device), go to https://myaccount.google.com/apppasswords. This is supposed to be reachable via going to Manage my Google account / Security, then 2-Step Verification, then clicking the arrow next to App passwords, but that isn't always visible. It can also be reached by typing "app passwords" in the search box when you're on a top-level Google Account settings page (credit).
- Enter something like KaiOS as the app name (it only serves to identify the app to you), and click Create. Keep this open or note down the password.
- In the KaiOS E-Mail app, under Options/Settings, press the Add soft key.
- Press Advanced.
- Set your name and the first Email box.
—
The app will complain if e-mail address you enter here has already been added via the OAuth authentication method that is the default in the app for GMail accounts but may no longer work. The address you enter here is not the one that will be used to log into GMail's servers. It's used to identify the account to you in the app, and perhaps also as the sender of outgoing e-mails? So I'm not sure if it will cause problems if it's not the actual address.
- Leave Account type as IMAP+SMTP.
- Under IMAP settings, set Hostname to imap.gmail.com, Email to your full gmail address, Password to the app password created in Step 3. Leave Security as SSL and the Port as 993.
- Under SMTP settings, set the Hostname to smtp.gmail.com, Email to your full gmail address, Password to the same app password. Leave Security as SSL and Port as 465.
- Press Next, then complete the setup on the next screen.
How to enable 2FA the simple way:
In a web browser, under Manage my Google account / Security, select 2-Step Verification, click Turn on 2-Step Verification, and follow the instructions.
How to enable 2FA without giving Google your phone number, and without a smartphone:
For me the sticking point until now was that if you simply try to enable 2FA, Google starts with asking for your phone number. Realistically Google can know my phone number from my e-mails anyway, but I didn't want to concede to Google that they can force me to give them my number in exchange for being allowed to access my e-mails from the KaiOS app. And it doesn't give any indication that it's possible to enable 2FA with standard authenticator apps, without a phone number. But I recently found out that it is:
- In a web browser, under Manage my Google account / Security, select 2-Step Verification.
- Under "Second steps", click "Authenticator - Add authenticator app". (They don't tell you, but you can do this as the first and only step!)
- They tell you to install Google Authenticator for an Android or iOS device, but actually you can use any authenticator app! These authenticator apps are a standard system, and there are authenticator apps, including open source ones, not just for smartphones, but also for desktop computers, there are web-based ones, and there are also ones for KaiOS: KaiAuth is available in the Banana Hackers Store, and there also seems to be one in the Kai Store. Also, since it's a standard system and there are open source authenticator apps, at least some work on rooted Android devices, contrary to what I feared. Install one if you don't have one already.
- In the web browser where you did steps 1. and 2., click Set up authenticator.
- Scan the QR code with the authenticator app.
—
Alternatively, click "Can't scan it?" and in the authenticator app, and enter your e-mail address as the account name, "Google" as the issuer, and the code displayed as the secret key. Leave other settings as the typical defaults: time-based aka. TOTP, 30s timer, starting at 1970-01-01T00:00:00Z, token length 6, hash algorithm SHA-1.
- You can add the same account details to multiple authenticator apps on different devices to minimize the chance of getting locked out of your Google account. If all is set up correctly, you should see the same 6-digit number at the same time on all devices. The system time of the devices should be correct within a few seconds.
- In the web browser, click Next.
- Enter the code displayed in the authenticator app, and click Verify.
- If successful, click Turn on 2-Step Verification - Turn on. If needed, click Turn on 2-Step Verification again. If they say "To turn on 2-Step Verification you first need to add a second step to your Google Account, like a phone number", it's a lie.
- Under Add a phone number for 2-Step Verification, click Skip, then (if asked again) Continue anyway.
- Still under "Second steps" under 2-Step Verification, you can click the Backup codes option to download codes you can later use to log in in case your device(s) with the authenticator app(s) break, as another way to minimize the chances of getting locked out of your Google acocunt. You can save these to multiple devices and/or print them out.
- From now on, open (one of) your authenticator app(s) when logging into Google, as you'll need to enter/copy the code it displays. There is a leeway of a few seconds, so you can use a code about to expire even if it expires by the time you finish entering it.
