An interesting feature of app-specific passwords -- which helps to mitigate the complaint in the article -- is that if you are logged in with one, you cannot ac

An interesting feature of app-specific passwords -- which helps to mitigate the complaint in the article -- is that if you are logged in with one, you cannot access some core settings to the account without going through the two-factor process. For example, you cannot change the master password, backup email account, or disable two-factor authentication using an app-specific password. So if one gets leaked somehow, you can always recover your account (though of course a lot of damage might have already been done).