If done properly, immensely.<p>Sites can log invalid password attempts, and unscrupulous sites could include attempted usernames and passwords.  That basically gives them a dictionary of accounts to try, because let&#x27;s face it, most people use the same password for multiple services.  Sometimes people&#x27;s muscle memory kicks in and they accidentally type their password into the wrong site, or the wrong field.<p>With Google&#x27;s 2FA, you need access to either a pre-printed list of emergency codes, or the ability to see the person&#x27;s incoming texts.  That&#x27;s where the &quot;if done properly&quot; caveat comes in.  Google Voice is generally a bad idea. If someone accidentally gets into your email because you left it open, they also have access to your incoming texts.