Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the case of Gmail, possibly your application-specific Gmail password.

My concern is that attackers can work around Gmail's 2-factor authentication by logging in through a client like mutt. While we can set application-specific passwords, we can't do that for every single client that exists, right? And yes, if someone has one's password, then the game is already over; but 2-factor is supposed to be an additional line of defense, and this appears to undermine that additional defense.

Is this a real threat? What is the recommended way of dealing with it?

share|improve this question

Application-specific passwords are the only workaround currently provided for applications which don't support two-factor authentication to Google. This does effectively bypass two-factor authentication, but only to a certain degree.

Obviously, the primary risk is that a compromised application-specific password can be used to access your account without requiring a second factor for authentication. Google provides a certain amount of mitigation to this risk by making the passwords much stronger than the typical user-generated password, and also by only displaying a given app-specific password once.

You should also be mitigating this by ensuring security of the environment where the app-specific password is displayed and stored, only using a given app-specific password once, and never copying an app-specific password to any location except in the password field for the application that needs it. Also, as always, don't use the application on networks that you don't trust.

You should also take advantage of the mechanisms Google provides for managing and monitoring app-specific passwords. Particularly:

  • Google alerts you to whenever a new app-specific password is created. Pay attention to these.
  • You can create custom names for app-specific passwords. Give them names that make sense to you.
    • Under "Select app" or "Select device" choose "Other (Custom Name)".
  • You can see when the last time was that an app-specific password was used. For applications that are constantly checking in, this may not be very useful information. However, if you happen to know a device has been offline for awhile and you see recent use, this can still be an indicator of trouble.
  • You can, and should, revoke app-specific passwords that are no longer in use or which show signs of abuse.

In the end, creation of an app-specific password effectively requires that you accept the risk of allowing that application to have permissions to your account without a second authentication factor.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.