> what does the author propose as an alternative if not application specific passwords? Actually restrict the "application specific passwords" to one applicati

> what does the author propose as an alternative if not application specific passwords? Actually restrict the "application specific passwords" to one application. The definition of "one application" could simple like the protocol (IMAP, CalDAV, Chrome sync, etc), or complex like an application-specific "signature" that changes between implementations/versions, or restricted to an IP address, etc.