Google's Two Factor Authorization is insecure

The authentication system was insecure for about seven months, by allowing the password to be changed despite two-factor authentication. See h-online for details.