4

While setting up a Google account on a Cyanogenmod 12 mobile phone, the app specific password that I generated is not accepted, but my real password is accepted. Since I have enabled two factor authentication, entering my real password would be bad because -

  • This is phone will have the same number to which Google sends 2FA codes. Storing the password on the same device as the one getting 2FA codes defeats the point of 2FA.

Is it possible to set up a Google account with app specific passwords only?

Cyanogen OS version 12.0-YNG1TBS103 Android version 5.0.2

Steps to repro

  • Go to Settings -> Accounts -> Add account -> Google account
  • Enter email
  • Go to https://security.google.com/settings/security/apppasswords using another device
  • Generate an app password with other(custom name) option.
  • Type the generated passcode on phone.
    • The passcode is rejected as invalid
  • Typing my actual account password succeeds - It sends the 2FA code to the set phone number(currently, this phone has no SIM)
Improve this question
4
  • It is perfectly possible to use app-specific password on Android and I use it too, but could you mention what steps did you follow to achieve the objective? Please be detailed and don't miss anything.
    – Firelord ♦
    Jun 12, 2015 at 19:41
  • @Firelord, added steps to repro
    – user80551
    Jun 13, 2015 at 4:02
  • Wow! I tried the steps and the issue has arisen on my side as well (Cyanogen OS 12.0, Build 0YL). Some answers I read suggests to reset your account password, or remove all accounts from device, or factory reset, but that will be too much without knowing what's actually wrong. Sorry, can't help as I need to look for the reason first. Good luck though.
    – Firelord ♦
    Jun 13, 2015 at 4:57
  • Same for me 2.5 years later, using android 6.0. I use google authenticator for TOTP, but that code is available on the same device I am logging in to. I would prefer if (when 2FA is enabled) if add account required an app-specific password, since full account access should be at least as secure as single-app access!
    – craq
    Feb 22, 2018 at 21:49

1 Answer 1

Reset to default
1

Apparently, Lollipop supports 2-step verification natively so it doesn't accept app passwords any more (as they are infinitely less secure). If you don't have access to authenticator app, change the associated phone number to the one you are using now and security token can be automatically verified via SMS.

Improve this answer
2
  • 1
    This still defeats the point of 2FA. The main account password and the 2FA step both take place on the same device.
    – user80551
    May 3, 2016 at 15:30
  • Obviously, 2FA doesn't make much sense in this case, but it spares you from having to generate an app password, which could theoretically be used on some other device, thus making it less secure.
    – Nikša Baldun
    May 16, 2016 at 12:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .