[nowen]

Google authenticator is only one-factor, possession of the shared secret in the phone. That's why it requires 'two-steps'.

[EGreg]

Well, the password on the phone is the other factor. No need to send the password anywhere.