4

While setting up a Google account on a Cyanogenmod 12 mobile phone, the app specific password that I generated is not accepted, but my real password is accepted. Since I have enabled two factor authentication, entering my real password would be bad because -

  • This is phone will have the same number to which Google sends 2FA codes. Storing the password on the same device as the one getting 2FA codes defeats the point of 2FA.

Is it possible to set up a Google account with app specific passwords only?


Cyanogen OS version 12.0-YNG1TBS103 Android version 5.0.2

Steps to repro

  • Go to Settings -> Accounts -> Add account -> Google account
  • Enter email
  • Go to https://security.google.com/settings/security/apppasswords using another device
  • Generate an app password with other(custom name) option.
  • Type the generated passcode on phone.
    • The passcode is rejected as invalid
  • Typing my actual account password succeeds - It sends the 2FA code to the set phone number(currently, this phone has no SIM)
  • It is perfectly possible to use app-specific password on Android and I use it too, but could you mention what steps did you follow to achieve the objective? Please be detailed and don't miss anything. – Firelord Jun 12 '15 at 19:41
  • @Firelord, added steps to repro – user80551 Jun 13 '15 at 4:02
  • Wow! I tried the steps and the issue has arisen on my side as well (Cyanogen OS 12.0, Build 0YL). Some answers I read suggests to reset your account password, or remove all accounts from device, or factory reset, but that will be too much without knowing what's actually wrong. Sorry, can't help as I need to look for the reason first. Good luck though. – Firelord Jun 13 '15 at 4:57
  • Same for me 2.5 years later, using android 6.0. I use google authenticator for TOTP, but that code is available on the same device I am logging in to. I would prefer if (when 2FA is enabled) if add account required an app-specific password, since full account access should be at least as secure as single-app access! – craq Feb 22 '18 at 21:49
1

Apparently, Lollipop supports 2-step verification natively so it doesn't accept app passwords any more (as they are infinitely less secure). If you don't have access to authenticator app, change the associated phone number to the one you are using now and security token can be automatically verified via SMS.

  • 1
    This still defeats the point of 2FA. The main account password and the 2FA step both take place on the same device. – user80551 May 3 '16 at 15:30
  • Obviously, 2FA doesn't make much sense in this case, but it spares you from having to generate an app password, which could theoretically be used on some other device, thus making it less secure. – Nikša Baldun May 16 '16 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.