I don't have two step auth on, but it wanted to check my number anyway, which was fine with me. If they'd set a longer timeout it would have been find with me.