Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When using Google's 2-step verification with services that can't use it, such as mail clients on smartphones and desktops, the solution is to create application-specific passwords for those services. Doesn't that make things less secure than just using one password as this opens up the account to more that one password?

share|improve this question
1  
They can't change your master password through one of the application-specific ones can they? So why would it be less secure? The passwords are also random gibberish, so its not like you should try to remember them –  Ivo Flipse Jan 13 '12 at 8:47
    
I see, that sounds comforting. Thanks! –  ihatetoregister Jan 13 '12 at 11:14
2  
For me, 'application specific' is extremely misleading. How exactly is is specific to one application? There are no restrictions on how many applications can use this password, nor is there any type of 'role' restriction. As far as I can tell, it gives full access to your account. –  UpTheCreek Apr 19 '12 at 7:18
1  
I can only assume what they mean is that they are specific to applications in general, not to a specific individual application. From what I've tested you cant change your account password using an app specific password. I wouldnt say it gives full access, but it does give anyone who has access to your computer full access to your emails. But this is just the same as using outlook without 2-step verification - the only difference being your master password isnt stored on your computer. –  OrangeBox Apr 24 '12 at 5:38

2 Answers 2

The idea is to use multiple application speficic password for each login you require, that way if your laptop is compromised (for example) then you can just revoke the app-specific passwords you used on your laptop. It also means no-one can use an app specific password to lock you out of your own account (as you cant use app-specific password to login to the webUI)

Have a look at my answer here for a better explanation.

Just to clarify: You cant login to any google service using an application specific password as the password but you can get access to the webui if you click View Inbox in Google Notifier or Google Talk (I dont know any other programs that have this function).

eg. Going to mail.google.com and using username: john.doe@gmail.com and the password: ztff jskp qdzm ofzw wont work.

Google Rejecting App Specific Password as login password

share|improve this answer

I haven't done extensive testing, but this is what I've seen so far.

Application specific passwords are sometimes more limited than to "one application." For example, on my Palm Pre, I have to use one password to receive mail, and one to send. Same with on Thunderbird.

Plus they are only displayed once. Notice that after you enter in the password, you can no longer retrieve it through the Google Accounts UI. If you typed it in wrong, you have revoke the old one and issue a new one.

In the end, secure enough to be annoying. That's usually secure enough.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.