In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google Chrome you have to create application-specific passwords.
Summary of the procedure
Let me get a few things straight. Do I understand the security implications of application-specific passwords correctly?
- Google does not automatically disable app-specific passwords when they are suddenly used out of their expected context (e.g. to access e-mail even though it was set up for Chrome sync).
- I have to generate additional passwords that all give immediate access to my account, bypassing two-factor authentication entirely. The higher the number of application-specific passwords the higher the chances are of a brute force attack succeeding.
- These passwords have a fixed length and don't contain numbers or symbols, which make them more susceptible to brute force attacks than a password with unknown length containing letters, numbers and symbols.
Assuming that I want to keep using features like IMAP access (which would force me to make at least one app-specific password), would I be better or worse off using two-factor authentication?