Only the owner's Google account is accepted; any other is refused before a session exists. Then an authenticator code, then the passphrase.

Not released: synthetic data only.