Don't be childish. This is exactly what most services does, especially for sensitive actions, like going to account settings. 2FA is quite obvious and present,

Don't be childish. This is exactly what most services does, especially for sensitive actions, like going to account settings. 2FA is quite obvious and present, more and more services push it to users by default. > Or a letter to your home. What is even funnier in your comment is that Google actually sent physical letters (actual snail mail) with confirmation codes to be entered by a user via web. When confirming company address (and that you "own" that company on google maps, for instance. Large auction service on my local market did the same thing 17 years ago, to avoid scams... I think demanding 2FA confirmation for such a sensitive action like downloading all your passwords is perfectly justified.