Great article on 2-factor auth. I didn't understand how easy it was, so I'm switching to it now. However, if you use a mail client and generate app-specific passwords that last forever, can't the hackers just hack via IMAP login instead which won't be 2-factor?

It seems like it would be better to use private keys on the client with 2 factor auth for authentication recovery. That way as long as you have the right private key locally that your mail client uses, you are set- otherwise you have to both provide a password and an SMS delivered code in order to use a different private key on the client.