Is the Django 1.7 email API "unsafe"?

Question

When I saw this answer , I found out that Google blocks certain applications for connection due to the “lack of modern security standards” in these applications, and I can do Google allows my account to connect from such applications - I have to do this explicitly.

This is due to a problem in the Django mailing list:

send_mail( u"Message", render_to_string('template.txt', {'data': data}), settings.EMAIL_HOST_USER, [dest['address'] for dest in settings.FORM_DESTINATIONS], html_message=render_to_string('template.html', {'data': data}), ) 

And my EMAIL_ settings containing the @ gmail.com account (neither SSL / 465 nor TLS / 587 worked).

Does this mean that Django 1.7 has an unreliable distribution mechanism? What does “safe” mean in this context and which Django mailing standards do not apply?

Edit Even when I provided the context for this question (sharp answer and related links / documents), some readers may not find where Google talks about “safe” / “insecure” applications. Entering here using the credentials of your google account, there is an option talking about “less secure applications” that lead to this page , which has a link “Additional Information”, indicating Here (this link does not require authentication) .

Answer 1

Sending email through SMTP using Django requires that you save your password in text form on your server. Apparently, Google sees storing the password in text form as a security risk and wants you to use either OAuth 2.0 authentication or two-factor authentication with specific application passwords. See http://googleonlinesecurity.blogspot.de/2014/04/new-security-measures-will-affect-older.html

It is up to you to decide whether you think that there is a security risk for storing the email password in text form on the server. Keep in mind that you usually store your database password in text format, so when an attacker can read your application’s settings, this is pretty much a game anyway.

I would suggest enabling two-factor authentication and using a special password for the application, especially if you use this Google account more than just sending mail from your server.