Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two-factor auth turned on for the Google Apps domain I administer. Is it possible to tighten the restrictions on application-specific passwords (eg the one-use, read-only passwords used for things like a Google Finance client on an iPhone) so that they can only read from one application?

As it's set up now, if an application-specific password is generated, it can be used on all Google services by someone who has it. Is there a way to limit these passwords to one application? So I can say "this password is only good for GMail" or "this password is only good for Google Finance".

share|improve this question

migrated from Aug 14 '12 at 15:09

This question came from our site for information security professionals.

This is not the right place for this question. Maybe it should be on superuser? – Rook Aug 14 '12 at 14:38
@Rook Agreed. It's partially a security question, but I do think that it's off-topic for here. SuperUser is probably the best place for this to go. – Polynomial Aug 14 '12 at 14:39
Sure. Can someone move it? I don't have enough points. – Kevin Burke Aug 14 '12 at 14:48
I've flagged it. I'll poke Rory or AviD in a minute. – Polynomial Aug 14 '12 at 14:55

This is not possible for now. You can use one and the same application-specific password for more than one App/Service, which in essence makes the password non app-specific :).

However, the application-specific passwords are only displayed once and after your close them, they are no longer visible/retrievable. In fact the password is as secure as you make it. You can choose to use the password for only one service and never see the password displayed again.

It is a whole other question, however about how easily retrievable/encrypted are the application specific passwords even though they are only used as tokens of information valid only for the time you gave access to your Google account for a specific application/service.

I agree however that making an application-specific password which could only be used for a single service provider makes things more secure.

Just make sure that the application-specific passwords that you enter are nowhere to be remembered by the application/service, web browser, etc.

The best way of controlling what's going on with your app-specific passwords is to verify the time of login for each password and see whether there are any discrepancies.

share|improve this answer

If you enter an application specific password, you do not need the password to your Google account. All you need is the application specific password.

If I can use a single application specific password to gain access to my Google account, how is turning on 2 step verification any more secure than not using it at all?

Without 2SV: 1 password to gain access = one possibility

With 2SV: (one or more application specific passwords to gain access) & (one password that requires an additional generated number) = more than one possibility

It seems to me that not using 2SV is actually more secure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.