bk99.de entertain the web since 1997

bk99.de
Hackaday · AuthenticationCurated

OAuth2 for Gmail on Linux and ESP8266

Summary

Hackaday explains token-based Gmail login so that scripts and microcontrollers can send email without a stored account password. Gmail documents its OAuth2 interface. The approach runs on Linux and the ESP8266.

Ideas

  • OAuth2 replaces the password with limited access tokens.
  • A refresh token renews short-lived credentials.
  • The ESP8266 calls Gmail interfaces over TLS.

Insights

  • Limited tokens reduce the damage from compromised devices.
  • Modern authentication increases setup effort and improves revocability.

Recommendations

  • Store refresh tokens encrypted and with minimal permissions.
  • Plan token revocation for lost devices.

References

Read the original article

Search the Web Archive

RFC · 2025

RFC 9700: Running OAuth 2.0 securely

RFC 9700 brings together current security practices for OAuth 2.0 and rejects risky historical patterns. A flexible authorisation framework needs secure profiles and defaults. Best practices can later explicitly replace early standard options.

Hostblogger · 2021

FIDO U2F as a second factor in the customer menu

Manuel Schmitt adds FIDO U2F to the customer menu and thereby supports physical as well as virtual security keys. FIDO U2F was offered in addition to SMS and OATH-TOTP. The web hosting management itself had not yet been switched over at the time of publication.

RFC · 2015

RFC 7519: JWT: Signed claims in JSON format

RFC 7519 defines compact JSON Web Tokens for transferable claims with signature or encryption. Self-contained tokens reduce lookups and make immediate revocation harder. Flexible cryptography requires strict checking of algorithms and claims.