Google's 2FA is kinda broken though, in that it generates permanent 'per-app' passwords that aren't actually limited to one app, they can be reused as often as you (or a data thief) wants. That always bugged me...