How to bypass outlook 2FA when used in PHP and IMAP? - php

Context
Recently, I have decided to activate 2FA to my outlook email.
However, due to this 2FA implementation, IMAP cannot access the mail server directly and this incur an error in my PHP script.
As of now the code that I have written to access my outlook with IMAP is simply $mbox = imap_open("{localhost:143}INBOX", "user_id", "password");
Question
Is there any way to bypass this such that when IMAP is reading from the mail server, it does not have to go through any authentication?

Apparently, outlook allows the users to create a password for those applications that do not support 2FA. You can find the reference link here.
However, this means that the site is still not fully secured.

Related

Failed to send email using codeigniter and phpmailer [duplicate]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 6 years ago.
Improve this question
I'm having problems with gmail smtp server. I already read many posts here in StackOverflow about that subject.
The best post I found about test the connection is this one.
Although it is very well explained the error I'm getting I couldn't find a answer:
Google SMTP just says "Please log in via your web browser and then try again". I'm completely sure that the password and the email (both in base64) are well encoded.
As you can see here, in this image:
,
there is just one difference I can notice: the user#gmail.com and password is sent in two steps. In the link above the guy sends both at the same time. Google didn't accepted that.
But the fact is, I write
auth login Y29udGF0...
(user in base64, googles responds: )
334 UGFzc3dvcmQ6
(wich means "Password: ")
YzQ2MjJmNWVi.... (paste my password in base64 and hit "enter")
Then Goggle says:
Please log in via your web browser and then try again.
534-5.7.14 Learn more at https://support.google.com/mail/answer/7126229
And I'm going through all this problem because #MediaTemple and #DreamHost are not working with PHPMailer. I already use PHPMailer for a long time ago, in so many different hosts, using SMTP but failed with (mt) and Dreamhost. Now I'm in middle of a project that it >must< work on these two hosts.
I know this is an older issue, but I recently had the same problem and was having issues resolving it, despite attempting the DisplayUnlockCaptcha fix. This is how I got it alive.
Head over to Account Security Settings (https://www.google.com/settings/security/lesssecureapps) and enable "Access for less secure apps", this allows you to use the google smtp for clients other than the official ones.
Update
Google has been so kind as to list all the potential problems and fixes for us. Although I recommend trying the less secure apps setting. Be sure you are applying these to the correct account.
If you've turned on 2-Step Verification for your account, you might need to enter an App password instead of your regular password.
Sign in to your account from the web version of Gmail at https://mail.google.com. Once you’re signed in, try signing in
to the mail app again.
Visit http://www.google.com/accounts/DisplayUnlockCaptcha and sign in with your Gmail username and password. If asked, enter the
letters in the distorted picture.
Your app might not support the latest security standards. Try changing a few settings to allow less secure apps access to your
account.
Make sure your mail app isn't set to check for new email too often. If your mail app checks for new messages more than once every 10
minutes, the app’s access to your account could be blocked.
I did this every time the problem happens:
https://accounts.google.com/DisplayUnlockCaptcha
problem sorted in my case!
I recently got this message, too, after I switched the data center location of a web application sending through Google SMTP.
The URL that apparently Google means is: https://support.google.com/mail/answer/78754. At that link, one of the steps is to reset your password. Not coincidentally, I also received an email from google with a subject of "Suspicious sign in prevented" that instructed me to change my password.
After resetting my password, I was back to using Google SMTP as usual.
I know this question is already been answered but for new comers those two solutions may help:
Make sure your gmail is allowing low secure apps to sign in, you can
turn it on here:
https://www.google.com/settings/security/lesssecureapps.
Change your password.
There are two ways to resolve this, and only one may work, depending on how you're accessing Google.
The first method is to authorize access for your IP or client machine using the https://accounts.google.com/DisplayUnlockCaptcha link. That can resolve authentication issues on client devices, like mobile or desktop apps. I would test this first, because it results in a lower overall decrease in account security.
If the above link doesn't work, it's because the session is being initiated by an app or device that is not associated with your particular location. Examples include:
An app that uses a remote server to retrieve data, like a web site or, in my case, other Google servers
A company mail server fetching mail on your behalf
In all such cases you have to use the https://www.google.com/settings/security/lesssecureapps link referenced above.
TLDR; check the captcha link first, and if it doesn't work, try the other one and enable less secure apps.
To send mail using Gmail SMTP, need to change your account setting. Login into your gmail accout then follow the link below to change your gmail account setting to send mail using your apps and program. https://www.google.com/settings/security/lesssecureapps
Note: This setting is not available for accounts with 2-Step Verification enabled. Such accounts require an application-specific password for less secure apps access.
I also came across this problem. Google detected my Mac as a new device and blocked it. To unblock, in a web browser log in to your Google account and go to "Account Settings".
Scroll down and you'll find "Recent activities". Click just below that on "Devices".
Your device will be listed. Okay your device. SMTP started working for me after I did this and lowered the protection as mentioned above.
There are at least these two issues I have observed for this problem:
1) It could be either because your sender username or password might not be correct
2) Or it could be as answered by Avinash above, the security condition on the account. Once you try SendMail using SMTP, you normally get a notification in to your account that it may be an unauthorized attempt to access your account, if not user can follow the link to turn the settings to lessSecureApp. Once this is done and smtp SendMail is tried again, it works.
Some apps are marked as less secure by google, so you just need to give access for those app so google will allow you to access its services to you.
follow this http://www.codematrics.com/your-imap-server-wants-to-alert-you-to-the-following-please-login-via-your-web-browser-gmail/

Using PHPMailer and gmail to send emails on Heroku

I want to log in to my gmail account from an Heroku app using PHPMailer but gmail restricts access since the remote server is an unknown device. Is there a workaround to this? I have tried using the captcha but its not helping.
Please note that i have no issue connecting to gmail on localhost. Problem comes when i deploy and my guess is that it is because gmail restricts it.
I actually stumbled across an answer. The solution is to actually follow this link and follow the instructions. First you have to allow less secure apps setting in your gmail account. Before following the link you have to sign out from all logged in accounts so that you do not allow for the wrong email. My mistake was that i followed the link before logging out thus allowed for a different email.

Preventing team from accessing Gmail (SMTP auth)

What is the best way to prevent developers from accessing the email SMTP information for an account we'd like to use for sending emails to customers?
I am thinking of using the native mail() function in PHP, and setup the credentials outside the code, in the php.ini file where the developers have no access.
The problem now is that the sysadmin can see the password. I am wondering if there's such thing as SMTP authentication using the OAuth tokens or something similar.

Send email with Google account using CodeIgniter

I'm trying to send emails with CodeIgniter using smtp.googlemail.com. No problems with code but Google is preventing me from sending that email - here's the email I received on my Google account:
A third party recently tried to use an application to connect to your
Google account.
We blocked the connection attempt in case it would be a hacker trying
to access your account.
If you have not made ​​this connection attempt, it may mean a third
party is trying to access your account. We recommend that you log into
your account and reset your password immediately. We blocked the
connection attempt in case it would be a hacker trying to access your
account.
If this is your account and if you are having trouble to get there,
follow the troubleshooting procedure explained at
http://support.google.com/mail?p=client_login.
I have followed the link and didn't find a solution.
I have the same issue, got an email from Google saying "Sign-in attempt prevented" when I was trying the same. I am ignoring what you have received from google and the text of email. Finally I solved the issue to send mail using CodeIgniter Email library today.
To use Google SMTP in CodeIgniter you need to make 2 (two) changes into Gmail account setting: (N.B. Please be aware that it is now easier for an attacker to break into your account -says Google)
Set off 2-step Verification.
Allow less secure apps: ON (or Enable)
Now use 'smtp_host' as ssl://smtp.gmail.com instead of smtp.googlemail.com
Hope this help.

is there something wrong with using php's native mail function?

i tried googling but sadly i get only documentations (or am i using bad keywords)
anyway
i can see that alot of programmers (even those im working with right now) does not seem to approve to using the php native mail function and resorts to using some other framework like sendmail? swift mailer etc...
i'd like to know why? are there really disadvantages to using the native mail function?
if so how does the mailing frameworkds solve that or how are they better??
There's nothing wrong with it for sending simple plain text emails.
However, once you get into multipart mime emails (say, you want an HTML version or to add an attachment) then you have to build the email yourself, and it can be quite tricky to get all the headers and encoding correct. In this case you're better off using a library.
The PHP manual for function mail mentions that there are some restrictions with the mail function and one of these are that the function opens and closes an SMTP socket for each email. The mail function works good when you just want to send a mail or two.
As far as I'm concerned, all of these problems pale in comparison to the major security problem:
Mail header injection: ( http://en.wikipedia.org/wiki/E-mail_injection , and php specific info: http://www.damonkohler.com/2008/12/email-injection.html )
Whereby a spammer bot spiders your site and, finding a vulnerability in your script that is easy to still have when using the very insecure mail() function, IS ABLE TO SEND EMAIL FROM YOUR SERVER TO AN ARBITRARY LIST OF CONTACTS, essentially turning your script & server into a cog in their spam email machine.
I recommend never using mail() with user input, and in general, just making use of PEAR::mail instead. http://pear.php.net/package/Mail/
Using PHP's mail() function requires a properly configured sendmail or equivalent on the host the program is running. However, the Windows implementation is a bit different. If you don't have your MTA configured properly, you won't be able to successfully send emails from your PHP scripts. Like another commenter said on this thread, PHP manual explicitly states that each call to the mail() function opens and closes a socket. This can cause unnecessary delay in script execution.
Additionally, your development and testing environment may not have a public static IP address. Your IP address might be blacklisted by DNSBL, Gmail, Yahoo! and other popular email service providers.
Your best bet in this situation is to use a properly configured external SMTP server. Chances are your employer has already provided an email account with SMTP access. If you don't have one you can use a Gmail account. Gmail provides SMTP access to all email accounts.
You can write scripts to open a socket connection to the external SMTP server. When there are tried and tested open source libraries for this purpose, why write your own?
Incidentally, I wrote a blog post on the very same subject yesterday: Using SMTP With Zend Framework - Solve Email Delivery Problem
Best regards,

Categories