>This would seem security 101, but apparently in order to make it easier for users, and to avoid them having to type their 2FA token in frequently, it is suffic

>This would seem security 101, but apparently in order to make it easier for users, and to avoid them having to type their 2FA token in frequently, it is sufficent to have logged in recently to a machine to satisfy to Google that you can make security level changes, if you know the password. In other words, it's 2FA, unless you're logged on, in which case it's 1FA. The author is wrong. It is still 2 Factor. The two factors are the password (something you know) and something you have (the session token on the machine). If your logged-in machine is compromised as was the case here, you are already in a world of hurt. Your bookmarks are visible. You could likely get the passwords by going to a bookmark site, allowing the password manager to autofill, and looking at the password fields using the browser developer tools. There are security vs ease of use tradeoffs. Making everything harder by assuming that even a trusted machine is compromised would result in much more of a painful user experience and would lead people to abandon password managers and 2 Factor. See for example UAC and Windows Vista.