security issue to Send mail using .Net (System.net.mail)

Question

Do we really need to enable " allow less secure apps " setting in gmail in order to send mail from application, even when the app uses https( SSL is enabled ). Then which application are considered as "More secure apps" that passes google security protocol?

Sachin Singh · Answer

These steps worked for me without allowing less secure apps :- 1.Go to myaccount.google.com 2.enable two step verification 3.Generate app password  4.use the password as normal password in the application.      Is this a good approach ?

Amit Gupta · Answer

Google takes security/privacy issue very seriously. There is a difference in SSL and 'allow less secure app', SSL is a certificate/set of protocol to transfer the data in an encrypted way where as 'allow less secure app' is prohibiting anonymous user/application to login.   If your application is sending mail from annother location, Google will stop login in unless you don't allow that it is you and not the other person.   If you use gmail for sending, you must have to grant permission, once you allow there is no issue for sending email from that system.

Sachin Singh · Answer

https://stackoverflow.com/questions/35699405/is-there-a-way-to-use-asp-net-to-send-email-through-a-google-apps-account-withou   This is the only solution i got from StackOverFlow.Is this the only solution?   Or what do you guys (professional developers) use to provide mail sending functionality in asp.net (MVC/Core) application.

Roshan Rathod · Answer

Would you please refere this links:
https://stackoverflow.com/questions/32260/sending-email-in-net-through-gmail
https://docs.microsoft.com/en-us/dotnet/api/system.net.mail.smtpclient.enablessl?view=netcore-3.1

Varun Setia · Answer

@aashima I believe this is very interesting subject. There might be trade-offs in what is best in terms of lines of code for OAuth or easy to use SMTP. If our application is architectured correctly we can prevent many security risks.

Sachin Singh · Answer

@Varun, Oauth is great but Oauth is used to get limited access to do something from user's behalf and there is lot of coding and needs a good understanding of OAuth flow too , which i am not , also i do not need to send emails from user's behalf ,i just want to use my gmail account for sending mails to my other account as if it is being sent by users ,its simple isn't it? The only problem is that "allow less secure app" .

Varun Setia · Answer

Google requires to use OAuth in Apps to prevent the security risk and let app be more secure. If we can add that as part of implementation flow. We might be able to work with more secure apps.
Reference-
https://support.google.com/a/answer/6260879?hl=en

Sachin Singh · Answer

@Amit gupta sir,then it is mandatory to enable "allow less secure apps" settings ?Then isn't it opens door to hackers to gamail account being used in application.   Then what is the purpose of using it in application?Is it just used for College projects(demo apps) and there is no value of this in real world application??

Sachin Singh · Answer

@varun ,you are correct ,but then what should be used to send mails?

Varun Setia · Answer

Here is what I could interpret. Less secure app is not only limited to SSL certificate. It also depends on what level of access you are providing to any app. This could be your sensitive information. If for any reason the website that is using Google Data gets hacked. They might have access to that sensitive information. This can be access to your photos, Google drive, etc. For more detailed information please refer to this
https://support.google.com/accounts/answer/6010255?hl=en
https://support.google.com/a/answer/6260879?hl=en