This question already has an answer here:
I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step verification. Is it worth it? How exactly does the application specific password work, for example after the first time the app logs in does Google somehow remember some sort of finger print of the app?
EDIT: after reading the possible duplicate it is a very similar question. However, even the answers to that do not address if 2-step verification it's necessarily safer. In a nut shell the answers given say that it is very difficult to brute force the generated application specific passwords, but the same could be said about a normal password (without 2 step verification) so in this sense 2 step verification would be pointless?