Sounds like yahoo have gone down the same route as gmail. Although the info below is talking about gmail, the same info will apply to what Yahoo are obviously now starting to use.

Is there an option to use OAuth2 for 'Authentication method' in Account Settings > Server settings and also in the Outgoing server (SMTP) setting?

It is likely to be available for IMAP and SMTP, but possibly not POP.

Located some info:

• http://forums.mozillazine.org/viewtopic.php?f=39&t=3012521&p=14645561
• http://kb.mozillazine.org/Using_Gmail_with_Thunderbird_and_Mozilla_Suite

Sounds like Yahoo has swallowed Google's "OAuth2" Kool-Aid. This is a login protocol, that instead of requiring a username and password for authentication, stores a token in a cookie on your system and uses that instead. This supports logging in to third party sites like Facebook without having to send your password.

Using OAuth2 for "secure authentication" will popup a window for your password using your systems default browser. It requires cookies to be enabled for google.com. It creates a token that will be used as if it was a stored password, by the password wizard. You can use a normal password instead for "secure authentication". However, unless you log into https://www.google.com/settings/security/lesssecureapps using a browser and select Allow to let less secure apps access your Google account Gmail may return an error when you try to login if you haven't had the Gmail account for at least 90 days. Using a password is just as secure as OAuth2, except for the possibility for somebody to use Tools -> Options -> Security -> Passwords -> Saved Passwords to view your saved password. This is really just an attempt to increase use of OAuth2, which supports their business plan by supporting logging into third party web sites such as Facebook or Twitter without exposing the users password.

If you are viewing emails only via your computer then it is just as secure.

good comment here explaining: http://security.stackexchange.com/questions/66025/what-are-the-dangers-of-allowing-less-secure-apps-to-access-my-google-account

I too have this problem (using imap on Yahoo). I tried turning on OAuth2 but then TB tells me "the imap server imap.mail.yahoo.com does not support the selected authentication method". Perhaps there's another yahoo server to use?

bcraigie The standard yahoo setting for imap: Type: IMAP

• Incoming Server Name: imap.mail.yahoo.com
• User Name: full email address
• Port: 993
• Secure connection: SSL/TLS
• Authentication Method: normal password

If you have logged onto webmail account and enabled 'two step authentication' because you use other devices eg: phone, to access your mail on server, then you will need to generate an application specific password. See info:

• https://help.yahoo.com/kb/SLN5013.html

If you do not use other devices then make sure 'two step authentication' is switched off.

In webmail Yahoo account tab to Account Info > Account Security select: 'Allow apps that use less secure sign in' . This should allow you access using your webmail password.

@Toad-Hall thank you. However, two step authentication is not turned on, (and thus the option to create app passwords is not available).

Turning on the "Allow apps that use less secure sign in" does fix the problem, but TB45 is not really a less secure app.

It does appear that Yahoo Mail are trying to encourage us to use their webmail because they do not appear to allow us to use OAuth2 which would solve the problem and allow us to turn off the less secure sign in option.

-)