Why is Chrome asking for the application-specific password and my account's password every time?

Question

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications either require one or the other, but not both? Secondly, why does Chrome not remember the application-specific password I gave it? Why do I have to go generate a new one every time I change the account password? And third, why doesn't Chrome just use the random number authentication instead of an application specific password?

I just find it ironic that it asks for both #1 and #2 unlike every other app and wanted to understand why.

Answer 1

I was also wondering why chrome ask every time a new application-specific password. Then I realized the reason is that the computer which chrome run on is not a trusted computer. I made it a trusted computer then chrome never asked specific password again.

Here is how to make a computer trusted, quoted from here

You can add your computer to the trusted list at any time. When you sign up for 2-step verification, you’ll be asked if you want to trust the computer you’re using. You can also mark a computer as trusted by selecting “Trust this computer” when entering a verification code.

Answer 2

Have you read http://support.google.com/accounts/bin/answer.py?hl=en&answer=180744 ?

#2 an application-specific password is for specifying which comp / device using this application

The system will generate 6 random digits across different time by using #2 , when you login again.

Answer 3

I have to recreate an application specific password around every two weeks on a random base. I couldn't it really figure it out what really the issue is for Chrome reporting an "Sync Error" and forces me to "re Sign in" with an new application specific password (because of the use and forget concept of it).

I have "Chrome sync" on 3 Mac Books, on 2 Windows VMwares, on an iPhone, iPad and at work on Windows. Its really a pain.

What I have done now is I created an "Application specific password" for all "Chrome Sync devices" and keep it in 1Password, so I can look it up later. I know this breaks the concept of the whole thing, but it saves me pain. Means for "Chrome sync" on multiple devices the value for 2-step verification is below or equal to zero because (PAIN > VALUE). Sorry Google.

But there seems to be light on the horizon. On the current Chrome Canary build as of today "27.0.1417.2 (Official Build 183216) canary" Chrome sync doesn't ask for an "Application specific password" at all anymore". It is just happy with your password and if you did not trust this browser before it is using now 2-step verification (via SMS or Google Authenticator).

So i guess it will be in the normal Chrome within the next weeks.