Login with "App Specific Passwords" ("App Passwords")

[chris001]

• It looks like a way to login using "app passwords" has been discovered.
• This is great news because it would let uses retain their account password for their own use only, and let the app have only its own "app password" for login and services. This greatly increases the security of the google account and would totally prevent the account from being hijacked, if the app password were ever leaked/stolen, because the app password is unable to access sensitive account interface screens such as to change the password recovery email address to perform a reset of the victim's master password, to disable 2SV/2FA, or change the victim's 2SV/2FA phone number.
• Adding this feature, login with "App Specific Password", would require it to be coded and tested.
• More details: https://duo.com/blog/bypassing-googles-two-factor-authentication
• Comment below if you're interested in having this feature, "Login with App Passwords", added to this app.

[citbr]

I was under the impression that Google would not let you generate app-specific passwords unless you enable two factor authentication. I positively loathe the idea of 2FA for a number of reasons:

1. I do NOT want Google to have my cell phone number under any circumstances.
2. The cell phone service I have is not from a major carrier and could be discontiuned at any time - or, I could lose or break the phone and as a result could wind up with a different number. Either way, I do not under any circumstances want to have to rely on my phone being available and having the same number it currently has in order to access my Google account.
3. Part of the reason some people use Google Voice is precisely because they don't have phone service, therefore any authentication method that requires cell service defeats the whole purpose for those folks.

So if "Login with App Passwords" can only be used if you enable 2FA, then that would be utterly useless to me. But if it can be used without any requirement to enable 2FA, then that would be extremely useful.

[chris001]

@citbr Good points.

• Google does NOT need to have your cell phone number in order to enable 2FA, which lets you use App Passwords.
• You can use a (borrowed) landline and voice call to obtain the verification code required for initial setup of 2FA. No mobile/cellular phone required.
• 2FA doesn't need to use that (borrwed/landline) phone number for anything after you setup 2FA that first time, one time, once. You CAN use the (borrowed/landline) phone for G account recovery in case you forget your login info and don't have other means to recover your account (see below).
• The 2FA setup lets you print out recovery codes (to put somewhere safe - wallet, cloud account, an actual safe, etc) to recover your G account in case you lose/forget something needed for login. No need to rely on mobile phone for this feature.
• G offers different types of 2FA. For example, you can use the G Authenticator app (on Apple IOS or Android). This app generates one-time passwords which you can use to login to your G account. This app doesn't have to be connected to the internet. When you login with G Authenticator one-time password, it doesn't need any text message or internet access to generate this one-time login password for you.
• You can also login with "Google Prompt" - the "Google" app asks you, "Did you just try to login Yes/No" - just tap Yes when you're trying to login right now.
• https://www.google.com/landing/2step/