Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications either require one or the other, but not both? Secondly, why does Chrome not remember the application-specific password I gave it? Why do I have to go generate a new one every time I change the account password? And third, why doesn't Chrome just use the random number authentication instead of an application specific password?

I just find it ironic that it asks for both #1 and #2 unlike every other app and wanted to understand why.

share|improve this question

closed as off-topic by Noordung, Xander, Iszi, Rory Alsop Sep 25 at 15:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Noordung, Xander, Iszi, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Use This One and Make a Password accounts.google.com/b/0/IssuedAuthSubTokens#accesscodes –  user16079 Nov 17 '12 at 4:04

3 Answers 3

Have you read http://support.google.com/accounts/bin/answer.py?hl=en&answer=180744 ?

#2 an application-specific password is for specifying which comp / device using this application

The system will generate 6 random digits across different time by using #2 , when you login again.

share|improve this answer

I was also wondering why chrome ask every time a new application-specific password. Then I realized the reason is that the computer which chrome run on is not a trusted computer. I made it a trusted computer then chrome never asked specific password again.

Here is how to make a computer trusted, quoted from here

You can add your computer to the trusted list at any time. When you sign up for 2-step verification, you’ll be asked if you want to trust the computer you’re using. You can also mark a computer as trusted by selecting “Trust this computer” when entering a verification code.

share|improve this answer

I have to recreate an application specific password around every two weeks on a random base. I couldn't it really figure it out what really the issue is for Chrome reporting an "Sync Error" and forces me to "re Sign in" with an new application specific password (because of the use and forget concept of it).

I have "Chrome sync" on 3 Mac Books, on 2 Windows VMwares, on an iPhone, iPad and at work on Windows. Its really a pain.

What I have done now is I created an "Application specific password" for all "Chrome Sync devices" and keep it in 1Password, so I can look it up later. I know this breaks the concept of the whole thing, but it saves me pain. Means for "Chrome sync" on multiple devices the value for 2-step verification is below or equal to zero because (PAIN > VALUE). Sorry Google.

But there seems to be light on the horizon. On the current Chrome Canary build as of today "27.0.1417.2 (Official Build 183216) canary" Chrome sync doesn't ask for an "Application specific password" at all anymore". It is just happy with your password and if you did not trust this browser before it is using now 2-step verification (via SMS or Google Authenticator).

So i guess it will be in the normal Chrome within the next weeks.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.