Add account to android device seems less secure than allowing access for a single app

Question

I just removed and re-added my google account to my android phone. I was surprised that in order to add the account, I had to supply my normal password, and a TOTP from google authenticator. It was not an option to use an app-specific password. Since google authenticator was installed on the phone in question, it does not seem to be an appropriate method for 2FA. Of course, a potential attacker would still require access to the phone AND my password, so there are still two factors of authentication, just not how I expected it.

Is my understanding correct, that an app-specific password would be more secure? If so, it doesn't seem right to me that allowing a single app to access part of my account is more secure than full account access.

Is it possible to change a setting to require "add account" on an android device to use an app-specific password, or at least to use a TOTP from a different device?

There is a similar question on the android stack exchange site. Is it appropriate to repeat the question here to get a security perspective on the question? I would also be open to suggestions for a google forum where I could post this question (I found two which gave me error 554).

Answer 1

Yes, you are correct. There are so many issues with using your normal password for the authentication on a 3rd party app. IFF the app implements the o-auth correctly, the app should never see the password.. but there's no way for the user to know if they have implemented it correctly. Such a shame.

Also, yes the 2FA doesn't help as much if the authentication app is on the same phone, but sometimes you need to authenticate to 2FA apps with fingerprint and it also would add an extra layer of security if an attacker wanted to install the app on their phone and had your password.