There is a problem with Google's two factor solution. If you need to use things outside the browser (eg checking email via imap, chat via xmpp) then you need t

There is a problem with Google's two factor solution. If you need to use things outside the browser (eg checking email via imap, chat via xmpp) then you need to generate secondary passwords. That is fine. What isn't is that those passwords are not scope restricted - ie if you generate a password for imap access then it can be used for anything else (eg chat).