Is Django 1.7 mailing API "insecure"?

Question

By seeing this answer I learned that Google blocks certain apps to connect, due to "lack of application of modern security standards" in those apps, and I can make Google allow my account to connect from such apps - I must do that explicitly.

This was due to an issue in Django mailing:

send_mail(
        u"Message",
        render_to_string('template.txt', {'data': data}),
        settings.EMAIL_HOST_USER,
        [dest['address'] for dest in settings.FORM_DESTINATIONS],
        html_message=render_to_string('template.html', {'data': data}),
)

And my EMAIL_ settings involving a @gmail.com account (neither SSL/465 or TLS/587 worked).

Does this mean Django 1.7 has an insecure mailing mechanism? What does "secure" mean in this context and what mailing standards is Django not applying?

Edit Even when I provided context for this question (a pointed answer and related links/docs) perhaps some readers may not find where does Google talks about "secure"/"insecure" applications. By entering here using your google account credentials there's an option telling about "less secure apps" which lead to this page, which has a "More Info" link, pointing Here (this link does not need authentication).

Answer 1

Sending email via SMTP with Django requires you to store you password in plain text on your server. Apparently, Google considers storing the password in plain text a security risk and wants you to use either OAuth 2.0 or two factor authentication with application specific passwords. See http://googleonlinesecurity.blogspot.de/2014/04/new-security-measures-will-affect-older.html

It is up to you to decide whether you consider storing the email password in plain text on a server a security risk. Keep in mind that you usually store your database password in plain text too, so when an attacker is able to read your application settings, it is pretty much game over anyway.

I would suggest enabling two factor authentication and using an application specific password, especially if you use that Google account for more than just sending mail from your server.