0

As far as I noted google's application specific passwords could be used to access for example, my Gmail, but from another email client (not web ui). So what is the point to use them then?

Also, does Google's 2-step authentication protects from cookie stealing? I mean, if someone steal my google cookies, will he be able to login to my Google Account?

Improve this question

2 Answers 2

Reset to default
2

The point is that it imposes extra limits on what can be accessed by an attacker. For example, if a third party service or app that accesses your Google account becomes compromised, and it gave away your password (!) you could easily revoke just that password, without effecting any other app or service that is using your account.

And, even if someone got access to your account, they would only have access for at most 30 days, and then they would lose access, which is better than them having indefinite access that you don't even know about.

Improve this answer
2
  • 1
    But does attacker able to change my Google Account password by using application specific password?
    – Paul Podlipensky
    Jan 18, 2012 at 0:03
  • No. I just tried using an App password to change my Account password and got the error 'Password is incorrect'
    – OrangeBox
    Apr 24, 2012 at 5:29
1

A good explanation from another site:

The idea behind app-specific password is enabling 2-factor authentication for protocols that don’t support 2-step authentication, like POP or IMAP.

If I get to know your primary password, I cannot access your account from the browser (because I won’t have the verification code) as well as from a client like Outlook (because they won’t accept your primary password).

App-specific passwords are applicable only to thick clients that require you to give your password to. You cannot use app-specific passwords in the browser. This means that if I get access to one of your app-specific passwords, I cannot log into your Blogger account or change your Gmail filters. Indeed, I can read your mail and impersonate you on chat. But I cannot, for example, lock you out of your account.

Source

Improve this answer
8
  • 1
    Well, I was able to see my web email account by clicking on "mail sign" (red tiny icon) at the bottom of GTalk and then access my Google account, although my GTalk use app-specific password.
    – Paul Podlipensky
    Jan 18, 2012 at 0:09
  • ah yes this is true, but you still shouldn't be able to get into the Accounts management area without a password. An attacker could still use an app specific password to access your email via IMAP (effectively the same as accessing the web interfase, but they will never be able to change your password).
    – OrangeBox
    Jan 18, 2012 at 1:45
  • 2
    Yes, as far as I know you can use (if you wanted) 1 app specific password for all your applications. It would just mean you'd have to store the password for future use - though I wouldn't recommend it. The idea is that by using multiple you can revoke the password(s) for which ever device / application(s) have become compromised.
    – OrangeBox
    Jan 18, 2012 at 2:52
  • 3
    Unfortunately I was able to change my password by using such access... Looks like GTalk use a bit different approach to show you email in the browser, i.e. it gains you full access even if GTalk was initially logged in by using app-specific password. Looks like a security issue as for me.
    – Paul Podlipensky
    Jan 18, 2012 at 17:41
  • 1
    Actually you are asked for your password before you can change it and you cant use an app specific password in the 'Current Password' field, you can only use your account password. Yes, you can gain access to the WebUI via programs using app passwords like Google Notifier or Talk, but someone cant change your password without knowing your original password first.
    – OrangeBox
    Apr 24, 2012 at 5:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .