Just tested it.

- Private Browser Window - Log in using backup code - can change auth app without another login.

So weird, because I cannot!

Maybe it's because I haven't used a 2FA code on this account in the past year? I typically stay logged out of my Google account and just have the email forwarded to another provider.

I guess could be that.

I too create a new chrome profile (and restarted my router) to get a different IP. (i.e) clean.

- Does this mean you are able to access emails but not change 2FA?

- If yes, do a take out ASAP.

- May be the backup codes are incorrect?

(Unless the machine learning folks on hn did some programming to prevent it!!!). For every one that complains about Google, I wonder how hn crowd pleasingly accepts pay check in the software industry.

The backup codes are what enabled me to log in, thankfully, so I know they work.

Thanks for the takeout advice.. onto that now!

> Maybe it's because I haven't used a 2FA code on this account in the past year?

Oh dear. You're almost certainly off the critical path of integration and end-to-end testing and may have hit a legit bug.

Errr... so now the story comes out that this is more of a weirder case than everyday use.

go to https://myaccount.google.com/security?hl=en

Then, https://myaccount.google.com/signinoptions/two-step-verifica...

There you can see Authenticator app.

(I am doing this on desktop. Not sure about phone)

Thanks for the followup. I'm also on desktop.

When I click the second link, I'm forced to reauthenticate. During that reauthentication my only option for 2-factor auth is... a valid 2FA code. Backup codes are not allowed.

I suspect since you originally logged in with a 2FA code (I'm guessing), your session is marked as "recently two factor verified", and when I logged in with a backup code, I was not marked the same level of "secure".

since you told me I am using a I tried without 2FA code but with backup-code

> When I click the second link, I'm forced to reauthenticate.

Here, I am being asked my password.

Then get that page.

Probably the difference, like parent says, is that you recently used 2FA, from the same OP address etc etc, so even though you have signed in with backup code now Google still trust your sign in more than OP.

There's probably a vague/inconsistent (possibly "AI") threat-score / heuristic. I've heard of extra security requirements being imposed for like 30 days or so when you haven't accessed for a long time (or on a new machine?) and it's just ironic how they currently put you in a catch-22