So a session token can downgrade an account from 2FA to 1FA.
I'm pretty sure Google forgot to inform users about this new feature.
I'm pretty sure Google forgot to inform users about this new feature.
Whether making that conversion or allowing disabling of 2fa without requiring the user to do a full authentication with both their password and a code is debatable. But 2fa is two of something you "know", "have", or "are" which password + session token meets.