It's not clear to me what that even means. Google Authenticator is the client, it doesn't get to pick the secret. I'm guessing it means "people did it wrong for

It's not clear to me what that even means. Google Authenticator is the client, it doesn't get to pick the secret. I'm guessing it means "people did it wrong for a while and Google Authenticator had to compatible so it allows secrets that are technically not allowed by the RFC"? In which case: still a site bug, not a GA bug :)