A basic security system should automatically revoke any session that repeatedly attempts and fails to get past this secondary authentication. So the attacker wo

A basic security system should automatically revoke any session that repeatedly attempts and fails to get past this secondary authentication. So the attacker would have to know in advance that you had recently freshed your session.