Suggestion: rename 'App password' to 'app token' to avoid confusion and for security reasons

[pmrt]

Hi,

I noticed that most non-technical users are unaware of the meaning of "app passwords" when interacting with third parties, this label "password" is very prone to confusion for them, so much that most third parties apps need to clarify and specify this for the users.

Because of this and based on my anecdotal experiences, most non-technical users behavior fall into 3 main categories:

1. Confused at first, but because they understand a password is something sensible they look it up and understand the difference, using it correctly.
2. Confused they opt not to use the app because they think it is unsafe.
3. Confused they like/need the app and risk it, don´t understand what's an app password and USE THEIR ACTUAL PASSWORD (potentially unsafe!)

So my suggestion is to change the 'app password' label to something that most non-technical users can immediately tell apart from their actual password, something like 'app token', etc.

This simple change could potentially prevent passwords leaks in the future for behavior 3 and encourage the use of third parties apps for behavior 2 (something important for an open protocol like this).

To consider: when oAuth is implemented and app passwords deprecated this would be less of a problem

[DavidBuchanan314]

I agree that it's a confusing concept, but I think changing it at this point would only lead to further confusion (inevitably, some clients/docs would adopt the new term, and others would not) - and as you mention, they're set to be deprecated soon™ anyway (iiuc).

Responsible clients can mitigate point 3 by rejecting passwords that don't match the syntax of an app password.