[JumpCrisscross]

I had this vulnerability cast into sharp relief recently through my Apple ID compromising my contacts. I sync my Gmail and Gmail contacts via IMAP to my iPhone and iPad using application-specific passwords. Both devices are backed up on iCloud. When my Apple ID was compromised the crook restored my iCloud backup to a new device, complete, to my horror, with the application specific passwords, which were used to stream out my contacts.

New devices and novel data requests do not revoke application-specific passwords which, as the article notes, are anything but specific. Also, Apple's security support is a 24-hour round-trip via an email technician.