3 ms·If the attacker has the phone, the second factor (typically sms) won't work very well.by parsnips 13y agoIf the attacker has the phone, the second factor (typically sms) won't work very well.