4 ms·
What happens for IMAP accounts? e.g through Mail.app or Thunderbird?
by kghose 15y ago
What happens for IMAP accounts? e.g through Mail.app or Thunderbird?
- ninjin 15y agoYou would use "Application-specific passwords", basically a one-off password used only for your IM or E-mail.
- JangoSteve 15y agoIt's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
- eli 15y agoThe sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
- drivebyacct2 15y agoHow would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
- bonzoesc 15y agoThat would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'
- drivebyacct2 15y agoUh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before) For example, https://developers.google.com/google-apps/gmail/oauth_overview https://developers.google.com/google-apps/gmail/oauth_overvi...
- dhugiaskmak 15y agoNot Invented Here.
- munin 15y agoyou can't use an app specific password to login to the gmail web interface and change your password. so while you could use a compromised application specific password to do horrible things (download all your email and send e-mail as you), you could not use that app specific password to immediately log in to the administration page for your account and lock the legitimate user out...
- eli 15y agoReally? I could have sworn I tried and it worked just like a full login. I signed up for two-factor very early so perhaps that was fixed along the way. Neat!
- reedlaw 15y agoSo the app-specific passwords are single-factor authentication keys. Why not just skip the two-factor authentication altogether and use a longer password/phrase?
- Navarr 15y agoThese are revokable, and don't allow access to change your password.
- chrisguitarguy 15y agoYou generate a application specific password and use it instead of your real password. Works like a charm -- just set it up on my phone.