Doing a bit of research, Microsoft integrated Oauth support into Outlook beginning with 2013, it is just that the process was a manual process as we see in the Yahoo Rogers model - when you consider setting an email connection say for Gmail, or Outlook.com on a phone now, using the defined yahoo, gmail, or outlook autoselection, it sets up the connection and setup of a secure device application related secure connection to the server by usually sending an SMS to a phone, or an alternative email, and you just confirm that you have set up the new email client.
Outlook and other apps that currently have OAuth did not have this ability to link back to the server and do the dual autorization with the confirmation to your other email or phone number by text, so the model became what Yahoo is currently doing.
Gmail and Yahoo and Outlook.com (hotmail) were using similiar models, such as a captua entry, or you could do 2 step authoriziation, or you could set using an unsecure app setting (which still exists in the full yahoo security settings, but Rogers is not giving access to those options, forcing directly to the creation of the individual passkeys per device/client.
I have taken a lot of time to review how we got to here with the Auth model - it has been backed into our phones for almost 4 years now - you could bypass it by setting up your email using the other, and POP server/IMAP server, SMTP server and appropriate SSL settings if needed. But up until now Yahoo gave you the option to opt out totally (and still does, but I wouldn't be surprised if they removed the option in the future).
All major email companies were allowing for opting out by declaring your older clients as "unsecure apps", bypassing Oauth completely.
Basically they made it easy for the older client users to bypass, but never told us that we were compromising our own security. Now Yahoo has forced us in this direction, subsequently Rogers with them, and this whole business a workaround to allow those apps to use the OAuth protocols that were added since 2013, and now OAuth2 in 2016 onwards - 2013 does not support Oauth2, only Office 365 and 2016 onwards supports it, again the reason for the workarounds.
It is a pure workaround, to get a slightly higher level of security, but definitely an awkward workaound.
As for writing down the password, there is absolutely no reason to do so. Once it is saved, you don't touch it again, unless you want to change it (good idea once in a while and yahoo actually in their system does force it at random times) You have one created passkey per device/client(on each device) so in your case, yes quite a few, but if you can create it from the member page, copy and paste into each client, or if on a computer say, copy and past it to an email and then copy and paste it, then for security purposes, delete it.
So whether we like it or not, whether their seems to be better models, this is not a model that was created by Microsoft. After lots of research it is a movement to requiring the highest security standard for all email services and clients, with a short term compromise for older clients where we had to use passwords, and the creation of the password in the member centre creates a one time passkey to enter in the password field, once you log in the first time, that client/device combination (each client on the device). which associates that client device combination with the server and then does not let you use that passkey again for any other device.
If you lose the password somehow in your configuration, then you just go back, delete it in the member centre, and create a new one.
This is an industry wide change that most of us were unaware of, I spoke with a friend who supports on an international scale Outlook with connection to Exchange mail servers, and he said, the Oath (first one) was implemented in 2013, and companies could choose to not use it as it was off by default on the servers and Outlook clients, but they always enforced it, then by 2016, it became required by Exchange/Outlook 2016 clients, and we have seen it on our phones for a while in the comfirming the email setup through text or email. We just didn't know anything about this change the most of us (I have worked in the industry for years, but now retired from it for almost 10 years, and have followed most things, but did not know about this one at all, but did recognize that something was happening, and didn't know about the outlook and other email client issue becauase I haven't used that model in 5 years now, so never knew it was happening. No reason to know.
I have yet to figure out a short way to say all this - it is definitely complex, and I am just understanding it now after a lot of calls to my past buddies and research on my own.
But to close allow me to responde to this quote from @RichardF
"Am am I right that the ideal model would be a password to authenticate the client / device to the server, and then one user controlled password per account (common to all clients)?
so 4 system generated hidden passwords, and 4 user defined passwords in my case. Not 16 generated passwords that in effect are my user passwords. "
What ever we may personally feel may be the ideal model, this is what the industry internationally came up with as a standard, and now email servers and companies are now beginning to enforce it rather than allowing for Oauth or 2 (as a user it appeared the same), a 2 step authorization, or just setting to allow use of less secure apps.
So we have no choice but to learn to use it and become comfortable, and decide whether we want implemented user control on the app level or OS level to keep prying eyes out when we step away.
In your case, your 16 individual passkeys (note I did not say passwords), are not just simple passwords, they are directly associated via security tokens with the passkey generation server, your email server and your email client - it just happens to work like your password did. that is the way it works, so what more can I say, accept that we have to learn to use it, the current steps are very clear and specific and if unsure, call tech support.
And yes, if it is the Yahoo security model laying under the member centre, you will have to have one passkey, being put in and saved in your password under your email user name, for each client/device combination.
You don't need to write it down and save it, as you will not be using it again, and even if you did, and someone tried to use it on another device, it would not work (once Rogers turns it all on). I know from testing a yahoo account, that it has to be different, and once you use that first email and passkey, if you then try to open the next one with the same passkey, it will tell you you used a one time passkey, and to go to the settings and create a new one. For that you have to know your original password you have always remembered, and changed occassionally and made strong for security.
Sometimes in technology, we just have to grin and bare it.
I will now leave it to the techs to support people who need clarification on how to set it up, and I suspect that most techs may not either know why it is this way, or don't have time to actually explain the technical parameters and the history of first its weakness and changes 3 times to its current form, and that some older apps may just plain not be compatable. It is like trying to run a MS XP - there is no security updates anymore, so it won't work with many things, or you really shouldn't do it.
Best of luck everyone, it is not far away.
Isn't change fun - not always, sometimes it can just be a pain, but some people need to put multiple locks on doors, alarms, security cameras, security patrols, depending upon the level of security you need. Our personal information requires the highest levels of security that companies provide, and companies have, for our ease far too often let us opt out of the best practices. It is long over due to force us to take responsibility for security, because it is not just our security, but everyone's - obviously Yahoo got caught in a major situation with the major hacks and this is one of the steps they are taking.
Bruce
RogersCilio
