Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

[jcoles]

Thunderbird 148 introduces PKCE, a more secure auth protocol. This should not have been done without warning as I have now lost access to email. Where are the instructions on how to set up PKCE?

My email is Yahoo with IMAP protocol. I use OAuth2 authentication. I see no PKCE option in the security settings. 

[wsm]

As https://support.mozilla.org/en-US/kb/thunderbird-and-yahoo indicates, login prompts should be expected because Oauth tokens are subject to expiration/renewal by the mail provider at any time. 

[jcoles]

But it rejects my password!

I have changed mailnews.oauth.usePrivateBrowser to true as you suggested, but I'll have to try login again later. I'm currently locked out for 30 minutes.

Important rule: Updates must never break anything.

[wsm]

> But it rejects my password!

Does your password still work for web access?

[jcoles]

Web access to what? Webmail? Attempts to access Yahoo webmail take me to Rogers Member Centre which also rejects the password. This might be a Rogers issue. Temporary I hope. I'll have to leave this for tomorrow. Too complex and stressful. Perhaps I'll just restore the older, usable Thunderbird.

[wsm]

Thanks for the info.  FYI I have closed comments in the other discussion thread.

If your password fails in webmail, then what hope is there for the password to be accepted through Thunderbird?

If the password is no longer good then you'll need to reset it.

[wsm]

Any luck?

[jcoles]

Yes. Resetting the Rogers password fixed the problem. Should I click "Accept as solution"? If so, where? No single posting contains the whole context.

Rogers member centre, which I rarely visit, has stopped recognizing my password before, and it's the member centre login that TB 148 was demanding in the popup window I showed you before. The password cannot really have been invalid as TB on my Android phone and TB 147 on my laptop never lost email access. 

Perhaps the password reset has done something in OAuth2, which Rogers/Yahoo imposed on us a few years ago. I understand it's a hidden additional password layer and I remember it was tricky to set up and get working. Technology grows ever more convoluted and opaque. Eventually only hackers will be able to use it.

[wsm]

> Important rule: Updates must never break anything.

Some triggered Rogers to renew your authentication token - Oauth tokens are subject to expiration/renewal by the mail provider at any time. That it happened during an update suggests that maybe they will require it again - not likely anything Thunderbird can do about it.

[jcoles]

Yes, it was a confusing coincidence. Rogers' password reset process, secured with a texted code, resolved the problem.