Defeats the purpose of 2-step verification, doesn't it? Ok, you still have to enter your ID and pw. Then a company you know nothing about has your verification code for as long as it's valid. That isn't long, and there probably isn't much they can do with it. Still, it gets some other company involved in the process. That would make me nervous.