I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device.
Are these used only to log into Google, or can they be used to log into other sites?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you're using a site that uses Sign in with Google+ (or whatever): yes. It's the exact same authentication endpoint so signin works the same way.
If you had to set up a separate account (only applies to the 2-step verification app): no. An example of this would be Dropbox.
The backup codes provided by Google will only work for Google's services.
The Google Authenticator works on the standard HOTP and TOTP algorithms described in their RFCs. Google just provided a convenient app to use it. HOTP and TOTP are relatively easy to implement algorithms and most popular languages has libraries supporting it. In fact, here is one I wrote for .NET.
It is up to each individual site implementing the HOTP or TOTP algorithms through Google Authenticator to provide a means to recover from the loss of said Authenticator.