OAuth is FAR more secure and just better in general. Whenever possible, we want to send users through that route.

Doing it in open source + local app is a bit tricky since we have to store our secrets for authentication in the app, which there isn't really a good way to do securely. This problem, however, is not unique to this app. Basic protection may be good from scrapers, but there will be no way to fully protect these values.

Current OAuth candidates:

• AOL
• Google
• Outlook (?)
• Yahoo

Users need to be able to authenticate with basic username and password when that's all that's available. This will be what all servers are likely to support so it should be our fallback at worst. Ideally we'd limit this wherever possible to only transmit password information over a secure connection.

We need some basic user info in the on-boarding process. Information we will need

• Initial email to set up with
• Name to use to address the user
• (Maybe) Profile picture to display for the initial email account