TL;DR - An attacker can bypass Google's two-step login verification, reset a user's master password, and otherwise gain full account control, simply by capturing a user's application-specific password (ASP).
How do I set up 2 step verification on Google?
How to Set Up 2-Step Verification for Your Google Account
Open the 2-Step Verification page and click Get Started.
Log in to your Google account, if needed.
Add your mobile phone number and select Text message or Phone call to complete the step.
Enter the code Google sends and click Next.
Click Turn On to enable 2-Step Verification.
How do I reset my 2 step verification?
Turn off 2-Step Verification
On your Android phone or tablet, open your device's Settings app Google. Google Account.
At the top, tap Security.
Under "Signing in to Google," tap 2-Step Verification. You might need to sign in.
Tap Turn off.
Confirm by tapping Turn off.
How do I sign up for 2 step verification?
With backups, you're much less likely to get locked out of your account.
Go to your Google Account.
Tap Security.
On the "Signing in to Google" panel, tap 2-Step Verification.
Add at least one additional second step like: Backup codes. Authenticator app codes. Backup phone.
Why is my 2 step verification not working?
If your phone was lost or stolen, we strongly recommend that you revoke your App Passwords and change your Google Account password. Once you're in your account, you can turn off 2-Step Verification until you can again get verification codes.
How do I turn off two step verification without signing in?
Turn off 2-Step Verification
On your Android phone or tablet, open your device's Settings app Google. Google Account.
At the top, tap Security.
Under "Signing in to Google," tap 2-Step Verification. You might need to sign in.