44

I'm very excited about Google's new two-factor authentication. Two-factor authentication means, in this case, that instead of just authenticating based on "something you know" (your password) you also authenticate based on "something you have."

In this case, the "something you have" is your mobile phone. Once this is enabled, you give Google your mobile phone number. Then whenever you try to log on to your account, Google sends a SMS message to your mobile with a six-digit number you enter to prove that you are really you. (There's a "remember me for 30 days" checkbox to make this non-awful on your own computer, which is, after all, "something you have").

How does this interact with IMAP and POP3 clients? What about accessing Gmail through the API?

Improve this question
1
  • For us Android users, this doesn't seem to be any less secure
    – Chris S
    Oct 20, 2010 at 14:50

1 Answer 1

Reset to default
39

What you need to do is generate an application-specific password for each client you want to authenticate to your Google account. Then enter the application-specific password instead of your password or password + verification code.

You can generate these application-specific passwords by going to this page (use your domain name instead of example.com):

https://www.google.com/a/example.com/IssuedAuthSubTokens?hl=en&service=mail

Google provides instructions for doing this on their Sign in to mobile or desktop apps page.

Improve this answer
7
  • How would this work for non-Google apps accounts?
    – Aron Rotteveel
    Feb 19, 2011 at 21:50
  • 5
    Access codes were (thankfully) renamed to "application-specific passwords", which is much more descriptive.
    – Josh Lee
    Apr 21, 2011 at 15:55
  • 1
    @Aron Rotteveel - yes, this works for all Google users
    – Mbrevda
    Dec 27, 2011 at 11:42
  • 1
    Note that the instructions are misleading. They say you'll never have to enter the application-specific password again. In practice I've found that for Google Browser sync, I'm having to enter it again every 30 days.
    – Kyralessa
    Feb 29, 2012 at 20:52
  • 6
    Useful information, but DO NOT use the link in the gray box--it goes to the "example.com" account and asks for your email and password. A phishing attempt? No, I just missed the phrase "customize it for your domain" the first time, which would only work if Google controls your domain (Google Apps). For a standard GMail account, I found the page here: accounts.google.com/b/1/IssuedAuthSubTokens, but the safest thing is to log in to Google, go to Accounts > Security > 2-step Verification > Edit > Manage application-specific passwords.
    – Mark Berry
    Sep 27, 2012 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.