Good point on the "trust for 30 days" thing. I generally use IMAP and only login to the web panel for administrative/settings purposes, and thus never check the

Good point on the "trust for 30 days" thing. I generally use IMAP and only login to the web panel for administrative/settings purposes, and thus never check the 'verify this machine for XXX days' box. Google should indeed require PIN for changing any account settings, if you have 2fa enabled.