When using Google's 2-step verification with services that can't use it, such as mail clients on smartphones and desktops, the solution is to create application-specific passwords for those services. Doesn't that make things less secure than just using one password as this opens up the account to more that one password?
Tell me more
×
Super User is a question and answer site for
computer enthusiasts and power users. It's 100% free, no registration required.
|
|
The idea is to use multiple application speficic password for each login you require, that way if your laptop is compromised (for example) then you can just revoke the app-specific passwords you used on your laptop. It also means no-one can use an app specific password to lock you out of your own account (as you cant use app-specific password to login to the webUI) Have a look at my answer here for a better explanation. Just to clarify: You cant login to any google service using an application specific password as the password but you can get access to the webui if you click View Inbox in Google Notifier or Google Talk (I dont know any other programs that have this function). eg. Going to mail.google.com and using username:
|
||||
|
|
|
I haven't done extensive testing, but this is what I've seen so far. Application specific passwords are sometimes more limited than to "one application." For example, on my Palm Pre, I have to use one password to receive mail, and one to send. Same with on Thunderbird. Plus they are only displayed once. Notice that after you enter in the password, you can no longer retrieve it through the Google Accounts UI. If you typed it in wrong, you have revoke the old one and issue a new one. In the end, secure enough to be annoying. That's usually secure enough. |
|||
|
|
