5 ms·
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
by JangoSteve 15y ago
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
- eli 15y agoThe sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
- drivebyacct2 15y agoHow would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
- bonzoesc 15y agoThat would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'
- drivebyacct2 15y agoUh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before) For example, https://developers.google.com/google-apps/gmail/oauth_overview https://developers.google.com/google-apps/gmail/oauth_overvi...
- dhugiaskmak 15y agoNot Invented Here.
- munin 15y agoyou can't use an app specific password to login to the gmail web interface and change your password. so while you could use a compromised application specific password to do horrible things (download all your email and send e-mail as you), you could not use that app specific password to immediately log in to the administration page for your account and lock the legitimate user out...
- eli 15y agoReally? I could have sworn I tried and it worked just like a full login. I signed up for two-factor very early so perhaps that was fixed along the way. Neat!
- reedlaw 15y agoSo the app-specific passwords are single-factor authentication keys. Why not just skip the two-factor authentication altogether and use a longer password/phrase?
- Navarr 15y agoThese are revokable, and don't allow access to change your password.