'Application-specific' is IMHO not just a friendly but a misleading name. They are simply not application-specific. Using one of these so-called application-sp

'Application-specific' is IMHO not just a friendly but a misleading name. They are simply not application-specific. Using one of these so-called application-specific passwords, you can delete calendars, mails and contacts. That is critical enough for most users. An additional concern is the usual 30-day authorization you give in order to avoid entering your 2-factor token again and again. Is there any way to de-authorize such a 30-day authorization? Anyway, I don't rule out that my perspective might be too strict. For must users, the whole Google 2-step authentication system is probably a very important step towards improved security.