If you don't like the application specific passwords, then don't create any. The only problem is that all your applications will need to support Google's two fa

If you don't like the application specific passwords, then don't create any. The only problem is that all your applications will need to support Google's two factor authentication natively. Given that most people want to work with existing applications and infrastructure, it's an application specific password is a reasonable compromise. Google aren't in a position to be able to do any better. At least we're getting an incremental improvement. One thing Google could do is to lock down a particular password to a specific service on first use, and as the author says to be able to revoke a 30-day authentication.