6

Just enabled 2-step verification for my Google account. I have installed Google Authenticator on my Android phone, and I set up an application specific password for the Google account associated on my phone.

This works great when just using installed apps like Gmail, Calendar and Google Reader.

But if I want to access Google Docs, Google Tasks or any other website that requires a Google login, I don't seem to be able to use a application specific password. I have to use my real password and then use Google Authenticator to make a code for the next step.

This means if my phone is stolen, revoking the password to my phone is pointless. The phone have already been verified, and all that is needed is my password, which the phones browser will have remembered.

I realize that I can take measures to ensure the phones browser doesn't remember my password, but that's just not convenient at all.

Am I missing something, or is there no elegant solution to this? Should I just let my phone know my real password?

As I see it, being able to login with application specific passwords on websites (which apparently isn't possible) is the only way I can revoke my phones access in a meaningful way.

Improve this question

1 Answer 1

Reset to default
8

It remembers your code for 30 days, but if your phone gets stolen, you just remove the "mobile application" (this means Google Authenticator) associated with your phone from the two-step settings page. This will immediately invalidate your code, and your phone browser will no longer log in*.

This is what the setting looks like in my account:

remove two-step

This does mean that you need to remember to remove at least two things should your phone get stolen: Your Google Authenticator application, and the application-specific password for your phone. You might also have other application-specific passwords to remove.

This also applies to any other device containing a logged in browser (like a laptop). The code will remain valid for 30 days unless you remove the Google Authenticator application in the settings. If it wasn't your phone that was stolen, you can immediately register the Google Authenticator application again and you will get new code to use.

*This is my understanding of how it works but so far as I can see this is not spelled out in Google's documentation anywhere.

Improve this answer
1
  • If you're worried about your phone being stolen, check out this android app which gives you several options if the worst happens: androidlost.com (I'm not involved with the app, just a happy user)
    – Colin Pickard
    Commented Sep 5, 2012 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.