Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I'm very excited about Google's new two-factor authentication. Two-factor authentication means, in this case, that instead of just authenticating based on "something you know" (your password) you also authenticate based on "something you have."

In this case, the "something you have" is your mobile phone. Once this is enabled, you give Google your mobile phone number. Then whenever you try to log on to your account, Google sends a SMS message to your mobile with a six-digit number you enter to prove that you are really you. (There's a "remember me for 30 days" checkbox to make this non-awful on your own computer, which is, after all, "something you have").

How does this interact with IMAP and POP3 clients? What about accessing Gmail through the API?

share|improve this question
    
For us Android users, this doesn't seem to be any less secure –  Chris S Oct 20 '10 at 14:50
add comment

1 Answer 1

up vote 37 down vote accepted

What you need to do is generate an application-specific password for each client you want to authenticate to your Google account. Then enter the application-specific password instead of your password or password + verification code.

You can generate these application-specific passwords by going to this page (use your domain name instead of example.com):

https://www.google.com/a/example.com/IssuedAuthSubTokens?hl=en&service=mail

Google provides instructions for doing this on their Sign in to mobile or desktop apps page.

share|improve this answer
    
How would this work for non-Google apps accounts? –  Aron Rotteveel Feb 19 '11 at 21:50
5  
Access codes were (thankfully) renamed to "application-specific passwords", which is much more descriptive. –  Josh Lee Apr 21 '11 at 15:55
1  
@Aron Rotteveel - yes, this works for all Google users –  Mbrevda Dec 27 '11 at 11:42
1  
Note that the instructions are misleading. They say you'll never have to enter the application-specific password again. In practice I've found that for Google Browser sync, I'm having to enter it again every 30 days. –  Kyralessa Feb 29 '12 at 20:52
4  
Useful information, but DO NOT use the link in the gray box--it goes to the "example.com" account and asks for your email and password. A phishing attempt? No, I just missed the phrase "customize it for your domain" the first time, which would only work if Google controls your domain (Google Apps). For a standard GMail account, I found the page here: accounts.google.com/b/1/IssuedAuthSubTokens, but the safest thing is to log in to Google, go to Accounts > Security > 2-step Verification > Edit > Manage application-specific passwords. –  Mark Berry Sep 27 '12 at 16:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.