Extracting Gmail emails using Python (post new "less secure app" feature changes)-CodePudding

As of May this year, Google has discontinued the option to allow "less secure apps" to access Gmail accounts using "simply" username and password information. This has meant that a Python code I had been operating to extract emails (see below some of the modules / elements used) now leads to the following error:

imaplib.IMAP4.error: b'[AUTHENTICATIONFAILED] Invalid credentials (Failure)'

Is there still a reliable way to extract email information from Gmail using a Python module? Any advice greatly appreciated

Selected code from current programme

import smtplib
import time
import imaplib
import email
import traceback 
import re
from bs4 import BeautifulSoup
import datetime
import pandas as pd
import requests
import env

ORG_EMAIL = "@gmail.com" 
FROM_EMAIL = "xxxx"   ORG_EMAIL 
FROM_PWD = "xxx" 
SMTP_SERVER = "imap.gmail.com" 
SMTP_PORT = 993
emails_regex_2= r'[\w\.-] @[\w\.-] (?:\.[\w] ) '
time_format = '%d %b %Y'
mail = imaplib.IMAP4_SSL(SMTP_SERVER)
mail.login(FROM_EMAIL,FROM_PWD)
mail.select('inbox')
data = mail.search(None, 'ALL')

CodePudding user response：

I had the same problem. I am also to lazy to rewrite my utility scripts. And in addition, I prefer not to, since I meant them to be scripts to check emails account, not specifically gmail account (I know google would want to abolish standardization of protocol, but there are still other email providers around).

The way that worked with me (so far. Google is now saying that this method is also "less secure", which is usually what they say 2 years before deactivating it), is to create app password.

For that you need to enable 2-steps validation (I know, it seems to be a step in the wrong direction for what you are trying to do, but it is not). And then to go to your google account, section "Security" and create a app password. That password is meant to be used by an application only. You can create many of them, one for each application that use your email. Then, you can use it in your script as you were using your user password before.

The idea, I surmise (since it can be weird that Google deems insecure a protocol with one password but not with another, even tho you can basically do anything with it) is that this password is supposed to be specific to an app. So your could easily revoke it if needed. Plus, it is generated, you can't choose it. And, well, you can basically do anything with it... except google specific operations. For example, a hacker who gets your app password could not change your google password, or close your account with it. But, well, still, it is surprisingly simple (I would have expected at least that, when creating the app password, you could fine-restrict what can be done with that password)