The Internet pane of System Preferences does not properly sync updated passwords to all applications. Furthermore, the failed authentication prompts on Mail and Calendar do not update a password changed in this way, neither on the account present in System Preferences > Internet Accounts, nor even in the application displaying the prompt.
I discovered this by fighting with Google's 2-factor authentication. Since most standalone applications don't support Google's verification protocol, 2-factor doesn't work with things like IMAP mail clients, making it useless without some workaround. The workaround is app passwords, non-recoverable tokens intended to be used by a single app or device. If you're trying to secure your Google account, It's pretty frustrating when those don't seem to work either.
After turning on 2-factor authentication, you need to switch to 2-factor sign on or start using app passwords. I created an app password for the System Preferences pane on my iMac, thinking that a single app password could take care of all the integrated apps. But it didn't seem to work. After entering the app password into System Preferences > Internet Accounts, I was treated to a barrage of password prompts. Like an insane person, I pasted the password into the dialog several more times and expected a different result. Then I tried to generate a new password several more times, with the same results.
After a few minutes of digging in Mail and overwriting any password I could find, Mail stopped complaining. Hooray! The excitement was short-lived. Calendar soon started throwing up password prompts too. I gave up and got back to work.
Today, I generated a new app password and pasted it into Calendar. Calendar reported that it could not connect to the server. I tried my Google account's main password, and Calendar reported that the server returned an error
.
I opened System Preferences again, determined to circumvent the app password system. I entered my main password there, and received a more helpful error: I needed to generate an app password. Of course. This is 2-factor in action: I shouldn't be able to use the main password here.
I generated a new app password, and entered it into Calendar again. Failure. I entered it into the System Preferences, which reported that Internet Preferences cannot connect to the account:
.
To hell with it. I deleted the entire account from the preference pane, added a new Gmail account, pasted in the app password. To my perpetual amazement and confusion, everything worked.
Until Apple fixes password syncing between System Preferences > Internet Accounts, Mail, Calendar, and the failed authentication password popups, consider the preference pane a write-once interface. That is, set it, and if you want to change it, delete the account in the pane, and then create a new one.