Enabling two-step verification on a service is a good idea... assuming it has been implemented correctly. In most cases, that verification depends on an SMS or a voice message. However, attacks against SMS are multiplying, and any security idea using that delivery method is losing its meaning. Fortunately, Google offers an official Authenticator for its services that lets us generate codes compatible with two-step verification locally, without messages or an Internet connection.
The password debate
Worried about the possibility of someone stealing your password? Some might call that paranoia, but personally I'd say you're recognizing the need to maintain a good level of security. The classic recommendation is to use a local password manager, in the style of KeePass. Many question the strategy of "one password to access them all", and then we find those who defend the vision of "one difficult password that can be remembered, to protect complex passwords that the user is not required to know". Still, both sides recognize a superior goal, which is to complement the password, and advance the use of other options, such as multifactor authentication. The most well-known variant, and by extension the simplest, is two-step verification. In short: Something you know, combined with something you have.
Google's answer
Google has offered this mechanism for its services for some time. The username and password form "what you know", while "what you have" is your mobile device. The problem is how the two connect. Google enables the use of SMS and voice messages. Personally, I think nobody listens to voice messages these days, and SMS has already been declared insecure on more than one occasion, by agencies such as the US NIST. So what's left? Google opens a third path, and that is its Authenticator, compatible with Android, iOS and BlackBerry. The great advantage of the Authenticator is that it generates codes compatible with two-step verification on the smartphone, without depending on an Internet connection or the mobile network.
Add to that the fact that it supports multiple accounts at once, and I believe the case is settled in favor of Google's Authenticator. The download is done through the stores on each of the supported platforms, and any details about its installation and operation can be found in the link below.
