That's interesting, thanks. I always thought the 2FA threat model was "Someone acquired my password" or else "someone has access to my email account and may tr

That's interesting, thanks. I always thought the 2FA threat model was "Someone acquired my password" or else "someone has access to my email account and may try to do password resets by email."