7 ms·

I'm not sure this is a meaningful threat model. "Well, the adversary can authenticate as me but they'll have to reauthenticate to change my credentials so I'm a

I'm not sure this is a meaningful threat model. "Well, the adversary can authenticate as me but they'll have to reauthenticate to change my credentials so I'm a little bit safe" is a major stretch. You've already been pwned at that point and not a lot of services force a 2FA step on actions post-login.

rocqua 5y ago
Most services I have used actually did require 2fa on authentication relevant changes post login. That's why I mentioned this slight protection. I'll grant the threat model is of marginal relevance.