If you’ve got a Google account you’ll be familiar with their custom 2 factor security model. When you sign into your device you are asked to verify the sign in on another device. Yes the support rolling code 2FA as well, but they make it hard to get to behind a few other clicks which pushes you to use their custom 2FA model.

Well here I sit on vacation in Ontario needing to sign a child into YouTube Kids but I don’t have an device authorized already with Google so I can accept the 2FA prompt. That prompt is being sent to my iPad back in British Columbia where I can’t access it.

Lucky for me every other Google account already had a rolling code 2FA setup so I can get into my important accounts. First thing to do the day after I get home is to add the final Google account to my rolling code app so I can access it anywhere.

Google’s custom 2FA model duped me and I feel annoyed I missed this obvious hole in my device setup.