[Android Apps and Games] GalaxyA325G:
I stress repeatedly that I'm just a regular user (not a developer) so I may have it wrong, but I have to agree with Marcel that to use "app passwords" is to use "2SV/2FA", which, for me, trades my privacy [that I want to preserve] for security [that I don't feel I need].

However I agree a lot of people think "app passwords" are different from "2FA/2SV" and the big marketing outfits seem to want us to believe that.

The problem with how the big marketing outfits handle pervasive things like privacy-vs-security is there is always an unexpectedly long "ripple effect" [which the big marketing outfits know full well but which the average user doesn't always know without actually testing it out].

If you ask Google, for example, they'll proudly proclaim that you don't have to give them your phone number... why heck... you can authenticate via any number of mechanisms, they say, such as:

1. OAuth2 (using an on-device Google Account or web OAuth2), or,

2. Autoforward Google mail to a non-Google account, or,

3. 2FA/2SV/MSV/MFA via a variety of authenticators, such as...

a. app passwords

<https://support.google.com/mail/answer/185833>

b. Some kind of "2FA/2SV/MSV/MFA authenticator" app

<https://support.google.com/accounts/answer/1066447>

such as...

FreeOTP Authenticator

<https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp>

Google Authenticator

<https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator>

Authy

<https://play.google.com/store/apps/details?id=com.authy.authy>

FreeOTP+

<https://play.google.com/store/apps/details?id=org.liberty.android.freeotpplus>

etc.

c. USB tokens

d. Time-based one-time passwords (TOTP)

e. SMS 2FA

f. Use the phone's built-in security key

<https://support.google.com/accounts/answer/9289445>

g. Use a physical "security key"

<https://support.google.com/accounts/answer/6103523>

h. Get a one-time security code from another device

<https://support.google.com/accounts/answer/2917834>

i. Enter one of your 8-digit backup codes

<https://support.google.com/accounts/answer/1187538>

j. Sign in using QR codes

<https://support.google.com/accounts/answer/9283368>

k. Set up a "trusted computer" for sign in

<https://support.google.com/accounts/answer/2544838>

l. Sign in with "google prompts"

<https://support.google.com/accounts/answer/7026266>

m. Any others?

Yet, there is this unavoidably pervasive "ripple effect" on privacy in that devious response above - which means - in the end - there are, (AFAICT), only two practical ways to authenticate after May 30th, 2022...

a. OAuth2, or,

b. 2SV/2FA

Of course, with OAuth2, there are also only two approaches (AFAIK)

1. OAUth2 via an on-device account, or,

2. OAUth2 via a web-auththication mechanism.

Note the privacy difference between those two is ASTOUNDING!

The privacy tradeoff I don't know how to calculate isn't the difference between on-device and via-web authentication (because that one is a no brainer)... but... the privacy tradeoff I am not equipped to calculate is what's the difference (in privacy) between...

A. OAuth2 to Google servers via web authentication, versus

B. Any of those 2SV/2FA mechanisms google pushes above?

Is OAuth2 via web authentication giving away less privacy than the 2SV/2FA methods (some of which require a login account elsewhere)?