They have a range of second factor options, including simple SMS to your phone, the use of their authenticator app (which presumably uses TOTP ([1]), and which

They have a range of second factor options, including simple SMS to your phone, the use of their authenticator app (which presumably uses TOTP ([1]), and which could therefore be replaced with compatible alternatives, e.g., LastPass's authenticator app), or USB keys containing a second factor (possibly TOTP-based). [2] has an overview of Google's TOTP implementation. They all do the same basic thing: userid and password let them know who you claim to be, which they validate using one of the second factors listed above. [1] https://tools.ietf.org/rfc/rfc6238.txt https://tools.ietf.org/rfc/rfc6238.txt [2] https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator