I was reading this response on SE about 2FA:
Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of traditionally the triad "something you have" (physical item, which may itself hold a secret), "something you know" (secret), and "something you are" (often biometrics).
The user goes onto imply that 2FA based on Google Authenticator is not really 2FA because if an attacker were to break into your phone or tablet using "a variety of radio interfaces running arbitrary, potentially hostile, software" they could potentially extract the secret that enables them to generate the same temporary passwords on another device.
However, it seems to me that even without the above argument, Google Authenticator is not really 2FA.
I always understood that 2FA was based on the idea that a potential hacker would have to 1) compromise your password and 2) gain physical access to your phone in order to compromise your account.
However, today it is possible to generate 2FA code using your phone, an app installed on your computer or an extension in Chrome (which only requires you to be logged into your gmail account to activate). An attacker would only have to compromise a user's gmail account to have sufficient capability to generate 2FA password.
Is 2FA based on Google Authenticator (or any other system that allows you to generate a pass code simply by knowing the user's email) considered real 2FA?