Description of problem: When using two-factor-authentication for my Google account I am asked for my application-specific password twice. Version-Release number of selected component (if applicable): Version : 3.6.1 How reproducible: Always. Steps to Reproduce: 1. Activate two-factor-authentication in Google account. 2. Add Google account via gnome-online-accounts Actual results: Am asked for username+password, for verification code generated by my mobile device AND for an application specific password twice. Expected results: Am asked for username+password and for verification code. (The application specific password should actually not be required at all when providing the verification code, but twice is certainly a bug.) Additional info: The request dialog is different the second time the application-specific password is required, the first time it is the "normal" gnome-shell dialog (black box in the middle, greyed out background), the second time it is a gtk3 dialog (grey, similar to e.g. a download dialog in style).
The situation for 2-factor authentication users is tricky. The 2 dialogs that you see are from 2 different applications. The black one is from evolution-data-server and the other one is from empathy. E-D-S uses CalDAV to talk to Google Calendars which does not support OAuth tokens for authentication at the moment. So we need a password. Empathy needs a OAuth2 token or a password for GTalk. In GNOME 3.6 we use OAuth (because GMail did not support OAuth2 at that time), so we need a password. Both these cases have been fixed for GNOME 3.6.2 by extracting the password from the embedded web browser, but that will unfortunately not work for 2-factor authentication. For GNOME 3.8 we will use OAuth2 for Google, which fixes the 2-factor authentication with GTalk, but it will still be a pain because of Google Calendar.
This has now been fixed in GNOME 3.10 for Fedora 20. *** This bug has been marked as a duplicate of bug 888822 ***