Is there no way to restrict services for Google's application-specific passwords? Those passwords have almost full access to your account. It seems like design flaw. Eg. if I generate generate a password for a google reader app which doesn't support OAuth, I want to limit that password to the Google Reader service and not give it access to my mail.
In fact, application specific passwords could have been implemented very similar to OAuth tokens. Any suggestions?