Disabling Google 2FA doesn't need 2FA if you're already logged in
This is 100% false. You need to have a 2FA authenticated connection or be on a 2FA authenticated device within validity period to change 2FA settings. You can elect to have 2FA not remember the device you have logged into as well (ie, the remember this device for 30 days option) if you are particularly paranoid.<p>The headline should say - You can disable Google 2FA on 2FA authenticated connections without re-authenticating.<p>This is a fantastic balance in terms of security and usability. I switched iphones and google authenticator did not bring my 2FA&#x27;s over, I got on my machine that had already authenticated and setup a new 2FA. Whew. Other systems were MUCH much harder to restore AND you could still get around 2FA but now with human involvement (social engineering risk). I&#x27;ve worked govt jobs with security so &quot;tight&quot; that everyone got the workarounds worked out - the social engineering would be as easy as I need reset for user X and they stopped even checking who anyone was the volumes were so high.<p>The loss in security is minimal here, and the loss is controllable, and it reduces pressure on other reset approaches (seriously, if you lock yourself out of google you will REALLY want to get back in).