Two-factor sign-in by email code or authenticator app

In Settings → Profile you choose how sign-in is confirmed: password only, a one-time code sent to your email, or a code from an authenticator app.

Changing your password now also asks for an emailed code.