How does Google's “authenticator number generator” work? I have two-factor authentication enabled on my Google account, and I have this app on my phone which generates a number I have to type when I'm logging in to Google-Mail.

But I don't understand how this number is validated on Google's side. My bank has a similar approach: they gave me this little gadget which also generates numbers.

How do such “authenticator number generators” work?
I found the accepted answer above a bit unhelpful -- it basically just says: "read these two RFCs".  So, on the theory that the quickest way to get the right answer to a question on the Internet is to provide a wrong one, and wait a few New York Minutes until someone corrects you, here's my attempt at a summary overview answer, based on a laughably cursory examination of the Wikipedia entry and the two RFCs.

basically your phone and the server app start by agreeing on a secret key, which they both know.  that happens just once, when you set up the app on authenticator.  

From there on in, the number that's generated every 30 seconds is based on SHA-1 hashing the secret key with the current time (in the form of a unix timestamp, rounded down to 30 seconds).

So, tl;dr: it's a hash of a shared secret with the current unix timestamp.

Or is it? Corrections welcomed...