3 ms·

Google's 2 step authentication is completely useless to some of us because they don't have actual per application passwords. For example if you use an IMAP cli

Google's 2 step authentication is completely useless to some of us because they don't have actual per application passwords. For example if you use an IMAP client to read gmail, then you can get an "application specific" password for it. But Google then allow that password to be used for anything. Essentially you've used 2 step authentication in order to setup 1 step authentication.

supergauntlet 13y ago
Yes, but they must first guess that password (which is ostensibly longer and more random than the typical passwords people choose.
- rogerbinns 13y ago
  > Yes, but they must first guess that password ... My chat client, IMAP client etc all save the password. Guessing the password is the least likely avenue of attack.
jonknee 13y ago
Considering Google's accounts aren't segmented by activity (there would be hundreds of activities with many added and removed all the time) that sounds like it would be a nightmare. Google's app specific passwords are revokable which is the important part. They also can't access sensitive account operations which means you can't reset the master password if you just have an ASP. If you lose control of your email password you can revoke it and generate a new one. The passwords are long and secure,
im3w1l 13y ago
Hopefully, the ASP can't be used for sending money?
dragonwriter 13y ago
> Google's 2 step authentication is completely useless to some of us because they don't have actual per application passwords. App-specific passwords are one-factor in any case (they are "something you know" just like any other password), and are an alternative to two-factor auth for certain places where Google's two-factor auth isn't supported for one reason or another. Google's 2-factor auth requires a device (usually, smartphone app) generated code alongside your regular Google password.
encoderer 13y ago
But that password gives you restricted access, right? It can't be used, for example, to change your account password or view your search history, etc? At least that's how I understood it? Obviously there's nothing Google can do about the fact that people want to access their email over things like imap that aren't built with Google 2-factor in mind.
- rogerbinns 13y ago
  I don't know which APIs get access to the passwords. In my case I would need app specific passwords for IMAP and XMAPP and that constitutes the majority of my interaction with Google.

supergauntlet 13y ago

Yes, but they must first guess that password (which is ostensibly longer and more random than the typical passwords people choose.

rogerbinns 13y ago
> Yes, but they must first guess that password ... My chat client, IMAP client etc all save the password. Guessing the password is the least likely avenue of attack.

jonknee 13y ago

Considering Google's accounts aren't segmented by activity (there would be hundreds of activities with many added and removed all the time) that sounds like it would be a nightmare. Google's app specific passwords are revokable which is the important part. They also can't access sensitive account operations which means you can't reset the master password if you just have an ASP. If you lose control of your email password you can revoke it and generate a new one. The passwords are long and secure,

im3w1l 13y ago

Hopefully, the ASP can't be used for sending money?

dragonwriter 13y ago

> Google's 2 step authentication is completely useless to some of us because they don't have actual per application passwords. App-specific passwords are one-factor in any case (they are "something you know" just like any other password), and are an alternative to two-factor auth for certain places where Google's two-factor auth isn't supported for one reason or another. Google's 2-factor auth requires a device (usually, smartphone app) generated code alongside your regular Google password.

encoderer 13y ago

But that password gives you restricted access, right? It can't be used, for example, to change your account password or view your search history, etc? At least that's how I understood it? Obviously there's nothing Google can do about the fact that people want to access their email over things like imap that aren't built with Google 2-factor in mind.

rogerbinns 13y ago
I don't know which APIs get access to the passwords. In my case I would need app specific passwords for IMAP and XMAPP and that constitutes the majority of my interaction with Google.