Google 2FA went from broken to wide open

Following the great Pixel-phone-wipe-out-update[0] I lost access to my authenticator app. Luckily I had back up codes, right.

Turn out Google broke the use of backup codes on the week after the pixel update. I could login, alright. But the Special security page asking for 2FA codes to allow you to disable/renew 2FA would not accept backup codes! it was clearly a lame bug as it showed the messages from the login page, but lacked the button the message mentioned.[1]

I decided to save my backup codes and not try again, until today. I had also added my account to a spare android phone, using only email and password.

Well, today the security page only asked me to click on a notification on that phone. Nothing else. Apparently "Google prompts" is now 2FA even though i never 2FA'ed the phone. [3]

[0] https://arstechnica.com/gadgets/2023/10/android-14s-ransomwa...

[1] https://youtu.be/TVwToPQ5L74

[3] blob:https://www.reddit.com/299e0500-26ef-43b3-901b-678351d99362