See https://support.mozilla.org/en-US/questions/1344702

Thank you, sfhowes, your instructions worked.

For the benefit of those who may have been led down blind alleys, here's what worked for me: contrary to the AOL instructions to remove/re-add my account, this wasn't necessary. Neither was setting any of the authentication methods to OAuth2. In fact, I kept all my old Verizon server names, ports, and other settings as they have been since before February's announcement.

This is what the aol article in sfhowes link says: Some older third-party email apps (that do not use our AOL-branded sign in page) require you to enter a single password for login credentials. If you've activated 2-step verification for your AOL account, you'll need to generate and use an "app password" to access AOL Mail from these apps.

1. Sign in and go to the AOL Account security page. 2. Click Generate app password or Manage app passwords. 3. Select your app from the drop down menu and click Generate. 4. Follow the instructions below the password. - Be sure to enter the password into your app without any spaces. 5. Click Done. 6. Use this app password and your email address to sign in to your email app.

I didn't understand all this, but just did it. I then opened Thunderbird, clicked 'Get Messages', was prompted for a pw (as usual) but entered the new generated pw instead of my old password -- and it worked. Thunderbird downloaded my email. I then sent an email using the same generated pw when prompted for a pw by Thunderbird.

But I don't understand how using this generated pw improves anything, seems like six of one, half dozen of another. And because the generated pw is unmemorable, I checked the option that lets Thunderbird remember a pw, which I think is more of a security risk. And to be clear, I did NOT activate 2-step verification option when following the instructions. Very strange.

I think the requirement to use an app password is intended to force the usage of 'strong' passwords, in place of the easily-remembered but 'weak' passwords that many, if not most, users employ. Whether or not this is a significant addition to security, or just security 'theatre', is debatable, but the fact remains it is a requirement that is mandatory if you wish to use that mail service.

As for the security of storing passwords versus entering them manually, I don't know the relative pros and cons, but I tend to believe it's probably easier for malware to intercept key strokes than to decrypt stored passwords.

Incredible...I had this problem and the steps above solved it in 10 seconds. At least for RETRIEVING emails.

Must admit I was confused when AOL said to "sign in to your email app," because I don't sign in to Thunderbird. They really meant to provide the generated password when Thunderbird shows the error box asking for a password when you try to get messages.

But when I tried to then SEND an email, got the same error message. I put in the same generated password, and that failed. Or so it seemed. After entering it several times, I am now sending and receiving emails. Hopefully that will last.

Thank you sfhowes.