Also if you explicitly log out but don't clear the cookies and then log in again no 2FA is required. Combined with the problem of 2FA not needing 2FA to be dis

Also if you explicitly log out but don't clear the cookies and then log in again no 2FA is required. Combined with the problem of 2FA not needing 2FA to be disabled logging in at a compromised computer can totally steal your account, even through 2FA is meant to prevent this. This mean never ever login to google on a hotel computer, library or any other computer you don't trust. Google 2FA has gaps. Other problems with 2FA include: - To enable 2FA with authentication app you need to first enable 2FA with SMS (but SMS 2FA is known to not be secure). - It will also implicitly enable all your android devices to be able to provide the second factor by unlocking the device and pressing ok on some google dialog. EDIT: Or at least it was the case for me. Due to e.g. A/B testing or regional differences it might differ. You might want to disable both. Through I can somewhat understand why they do it as if you then lose access to you 2FA app you are also locked out of google, or at least should be if there are not other "gaps" in the account recovery process. Note that recovery keys are still another thing you can enable, print and put in a save (or whatever way you want to keep them save). And tbh. auth app + offline securely stored recovery keys seem to me the best option.