Pidgin + Google Apps for Your Domain with 2-factor Authentication

1. Create an app-specific password for Pidgin: https://security.google.com/settings/security/apppasswords
2. Add a new account in Pidgin:
   • Basic tab:
     • Protocol: Google Talk or XMPP
     • Username: {yourusername}
     • Domain: {yourdomain.tld}
     • Resource: {left blank}
     • Password: {app-specific password}
     • Remember password: Checked
   • Advanced tab:
     • Connection security: Use Old-style SSL
     • Connect port: 443
     • Connect server: talk.google.com
     • File transfer proxies: proxy.eu.jabber.org (the default)

Hat-tip: https://superuser.com/a/894407