Possible solution: for each app-specific password Horde stores the 
backend password (eg: LDAP, IMAP) in an encrypted form.  The 
app-specific password is used as the encryption key.  For safety 
reasons, the app-specific password is not stored, only a hash of it.

There might be other ways to implement it safely, this is just an idea.

Please see the attachment.

How would this work? ActiveSync needs authenticated access to Horde 
and the applications (not to mention access to the IMAP server through 
IMP). Using a different password for each application, or even just 
for ActiveSync access would prevent authentication to at least some of 
the data that is needed.

What I am requesting is simpler, is "Application-specific passwords".

Please see this:
https://support.google.com/accounts/answer/185833

And a video explaining it:
http://www.youtube.com/watch?v=zMabEyrtPRg&t=2m13s

It is possible to implement this independently of Horde (eg: for email 
it could be done in the imap server), but we need support for SyncML 
and Activesync, and also a Horde module for the password management.

Are you requesting two-factor authentication actually?

Except we already have this.  See, e.g., IMP/Gollem - they can use 
authentication different that Horde's.  How is what you are asking for 
different than this?

It would be great if we could use a secondary authentication system 
for different parts of Horde.

For example, I could have my normal authentication to use every 
function in Horde, IMP, etc. And then a secondary one that only works 
to synchronize my cellphone over SyncML, or possibly for other things.

That way if my secondary password is compromised the damage is limited.
I think google has a similar system.