App-Specific Password phishing and how to prevent it

App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications that do not support modern authentication (e.g. OAuth 2.0). For example, you might use this feature to allow a third-party mail client access to an email account by logging in with your Microsoft, Google, or Apple account.

The logic behind this is that it is comparatively more secure than giving your critical IdP password to less secure apps —…