Re: more on starttls, gnutls-cli and using tls for mail

[Tim Cross]

On Mon, Aug 15, 2011 at 5:38 PM, Vijay Lakshminarayanan
<address@hidden> wrote:
> Tim Cross <address@hidden> writes:
>
>> On Sun, Aug 14, 2011 at 10:02 PM, Vijay Lakshminarayanan
>> <address@hidden> wrote:
>>> Karl Fogel <address@hidden> writes:
>>>
>>>> Leo <address@hidden> writes:
>>>>>I use smtpmail-auth-credentials to pass different user names for the
>>>>>gmail smtps I am using. With the new smtpmail.el I haven't found a way
>>>>>to do that.
>>>>
>>>> Yes, I'm in that situation too now -- which is why I think it's so
>>>> unfortunate that `smtpmail-auth-credentials' went away :-(.
>>>>
>>>> I've found a way to do it, using the new smtpmail.el, but it's ugly.
>>>> I have `message-send-hook' set up ~/.authinfo for every mail message,
>>>> and then I remove the file afterwards in `message-sent-hook'.  Search
>>>> for "kf-set-up-authinfo" in [1] if you want the code.
>>>>
>>>> Naturally I hope we'll restore the lost functionality to smtpmail.el, so
>>>> this kluge will become unnecessary!  The ideal behavior, I think, would
>>>> be to pay attention to ~/.authinfo when it is present, but fall back to
>>>> trying `smtpmail-auth-credentials' when it's not.
>>>
>>> I have multiple GMail accounts and I use a hook to use the correct
>>> authentication depending upon which account I'm using.
>>>
>>> The hook function is
>>>
>>> (defun change-smtp ()
>>>  "Change the SMTP server according to the current from line."
>>>  (save-excursion
>>>    (let* ((username-fn
>>>            (lambda (from)
>>>              (when (string-match "\\<\\([A-Za-z.]*\\)@" from)
>>>                (setq from (match-string 1 from))
>>>                ;; Gmail addresses can have dots in them, so sending
>>>                ;; an email to address@hidden or address@hidden
>>>                ;; will go to the same destination.  So credentials
>>>                ;; for both addresses are stored under the symbol
>>>                ;; `abcd'.
>>>                (setq from (replace-regexp-in-string "\\." "" from))
>>>                (intern from))))
>>>           (from (save-restriction
>>>                   (message-narrow-to-headers)
>>>                   (message-fetch-field "from")))
>>>           (username (funcall username-fn from))
>>>           (credentials (cdr (assoc username *gmail-auth-credentials*))))
>>>      (if credentials
>>>          (setq smtpmail-starttls-credentials credentials
>>>                smtpmail-auth-credentials credentials)
>>>        (error "Could not find auth credentials for %s" from)))))
>>>
>>> (add-hook 'message-send-hook 'change-smtp)
>>>
>>> where the variable *gmail-auth-credentials* maintains all my user
>>> account info as an alist in the form:
>>>
>>> ((account1 ("smtp.gmail.com" 587 "address@hidden"  "password1"))
>>>  (account2 ("smtp.gmail.com" 587 "address@hidden"  "password2"))
>>>  (account3 ("smtp.gmail.com" 587 "address@hidden"  "password3"))
>>>  (account4 ("smtp.gmail.com" 587 "address@hidden" "password4")))
>>>
>>> I save it in a file ~/.gmails.gpg and in my .gnus I have
>>>
>>> (eval-when-compile
>>>  (load "~/.gmails.gpg"))
>>>
>>> Takes care of authentication.  Of course, now that this is out, someone
>>> could possibly get my email account information by convincing me to
>>> download their cool emacs package.  But I don't think I'm that important :-)
>>>
>>> Hope this code helps someone.  As with other Free Software licenses,
>>> this comes with NO WARRANTY.
>>>
>>>> -Karl
>>>>
>>
>> You might be able to clarify something for me. Your the second person
>> I've come across in as many months who changes smtp server based on
>> the from address. Your process is even more of puzzling and I'd like
>> to understand what the reasons are.
>>
>> For example, if your already authenticated with gmail's smtp server,
>> why re-authenticate with different credentials just to send a message
>> with a different from/return address? As far as Iknow, this is not
>> required and it seems to be adding a lot more complexity for no
>> apparent reason that I am aware of.
>>
>> Is there any technical reason that requires this? I frequently use
>> authenticated smtp, but just auithenticate as one user and send email
>> with from/return addresses of different users with no problems.
>>
>> I'm interested  knowing what the use case is for doing this as it
>> seems unnecessary and something which is making things needlessly
>> complicated. If there is a good technical reason to do it, I would
>> like to know so that I can be prepared should I need to modify my
>> setup and because I sometimes assist in maintaining a mail client and
>> like to be familiar with the various use cases.
>
> Originally, I used your technique too but recently I got a warning on
> one of my gmail accounts regarding "suspicious activity on the account"
> and had to change my password, receive an authentication code to my
> phone to confirm the account etc., after which I switched to my hook.
>
> Now, I don't know if changing the from address while being authenticated
> to another /caused/ the issue but I haven't faced this issue after
> switching to my current scheme which, admittedly complicated, isn't so
> hard either.
>
> On the browser, gmail allows you to explicitly change your from address
> when replying but it first requires confirmation that you control the
> other address.  I have not linked my accounts with each other this way
> and I don't want to.
>
>> thanks,
>>
>> Tim
>
> --
> Cheers
> ~vijay
>
> Gnus should be more complicated.
>

OK, thanks Jijay. So, it would seem the use case is possibly something
specific google has done to detect possible abuse of an email account.
I've not run into this myself, but at least this gives one possible
data point on why this additional complexity may be required.

Tim