3 ms·

Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but

Your first example is interesting, but it's much more limited than you describe. The attacker can't use your credentials to authenticate their own session, but they have complete control over the authenticated session on your laptop. I can't think of an account I have where that would be meaningfully less bad.

askvictor 4y ago
The attacker has access to all of your authenticated sessions on your compromised laptop. They don't have access to any un-authenticated accounts which have 2FA enabled.
- bb88 4y ago
  Further because 2FA is simpler, a session can time out in a shorter amount of time.