Hacker News Reader

Just curious, why would you want Application-specific passwords? They're far more insecure and still have access to all your Google services. Application-specific password would only make sense if Google actually let you limit access to a certain subset of Google-features.

View on HN

They are not necessarily more insecure? And the great part about them is the fact that if an app goes rogue then its password can be revoked. Also, while they can access my data, they can't change data. No one can log in with an application specific password and steal my account.

They are one less factor needed in order to access an account that has 2FA enabled, so in that regard, I consider them less secure.

You're right about the part where they cannot hijack your account, but change data? Sure they can. They can delete all your emails, calendar events, contacts, images on picasa, the list goes on. It has unrestricted access to all Google-services associated with your account.

Because I can revoke Application-specific passwords and they are more limited in that there are a set of settings that they can't change (can't change my email address, change my password, setup forwarding, add more application-specific passwords, etc).

Reply on news.ycombinator.com