external email programs bypass two-factor authentication

[userino]

Hi, I noticed that I can log in to an email program with a simple password, even though I have two-factor authentication enabled everywhere (i.e. in Cloudron itself and in SnappyMail).
Is this a bug that you can log in just like that? After all, there are also app passwords....

[ccfu]

When you send and receive email with an email client you are logging in to the mailserver and there is no 2FA for IMAP or SMTP.

[girish]

@userino yeah, it's that way because IMAP/SMTP have no concept of sessions. This means that you might have to repeatedly enter 2FA token which would in turn make using mails clients quite unusable.

I recommend generating an app password for Email (what I use personally) and using that as a "throwaway" password. It will work only for Email an won't let you login to other apps.