Gmail only asks for your user credentials during the initial login, and that login session can last for weeks at a time. That’s not as secure as it could be, so soon Gmail will start posting 2FA challenges if you try to access any “sensitive” settings, even when you’re already logged in. From a report: The newly protected settings are for filters, account forwarding, and IMAP. Soon, poking around in any of these options will boot you into a “Verify it’s you” 2FA prompt, and you’ll have to pass the challenge on your phone (these settings are only available on the web). If this 2FA challenge is failed or not answered, you’ll get a bright red “Critical security alert” pop-up alerting you to the attempt on all your trusted devices.
