Eli5: Why do I need to type a password, when I use Google authenticator anyway? Shouldn't username and the 6 digits be enough? It's refreshing every 30s, shouldn't that be secure enough? If the server would enforce a delay of 0,5s after each try, the time won't be enough.