Two-factor codes change every 30 seconds, and sign-in used to accept only the code for the exact second it arrived. A code read just before the window turned over, or a server clock a few seconds out, was rejected as if it were wrong. Sign-in now accepts the previous and next code as well, which is the usual tolerance for an authenticator app. Failed attempts are also recorded properly now, including how far out of step a rejected code was, so a genuinely wrong clock is easy to tell from a genuinely wrong code. New two-factor setups use a shorter, standard-size secret that every authenticator app reads the same way; existing setups are unaffected.
Two-factor codes no longer fail over a few seconds
Sign-in now accepts the code either side of the current one, so a phone and a server that are slightly out of step still agree.