OS X Yosemite and Google App Passwords

The Internet pane of System Preferences does not properly sync updated passwords to all applications. Furthermore, the failed authentication prompts on Mail and Calendar do not update a password changed in this way, neither on the account present in System Preferences > Internet Accounts, nor even in the application displaying the prompt.

I discovered this by fighting with Google's 2-factor authentication. Since most standalone applications don't support Google's verification protocol, 2-factor doesn't work with things like IMAP mail clients, making it useless without some workaround. The workaround is app passwords, non-recoverable tokens intended to be used by a single app or device. If you're trying to secure your Google account, It's pretty frustrating when those don't seem to work either.

After turning on 2-factor authentication, you need to switch to 2-factor sign on or start using app passwords. I created an app password for the System Preferences pane on my iMac, thinking that a single app password could take care of all the integrated apps. But it didn't seem to work. After entering the app password into System Preferences > Internet Accounts, I was treated to a barrage of password prompts. Like an insane person, I pasted the password into the dialog several more times and expected a different result. Then I tried to generate a new password several more times, with the same results.

After a few minutes of digging in Mail and overwriting any password I could find, Mail stopped complaining. Hooray! The excitement was short-lived. Calendar soon started throwing up password prompts too. I gave up and got back to work.

Today, I generated a new app password and pasted it into Calendar. Calendar reported that it could not connect to the server. I tried my Google account's main password, and Calendar reported that the server returned an error.

I opened System Preferences again, determined to circumvent the app password system. I entered my main password there, and received a more helpful error: I needed to generate an app password. Of course. This is 2-factor in action: I shouldn't be able to use the main password here.

I generated a new app password, and entered it into Calendar again. Failure. I entered it into the System Preferences, which reported that Internet Preferences cannot connect to the account:.

To hell with it. I deleted the entire account from the preference pane, added a new Gmail account, pasted in the app password. To my perpetual amazement and confusion, everything worked.

Until Apple fixes password syncing between System Preferences > Internet Accounts, Mail, Calendar, and the failed authentication password popups, consider the preference pane a write-once interface. That is, set it, and if you want to change it, delete the account in the pane, and then create a new one.