[toasterlovin]

But don't many sites require a second authentication to modify access to the account (change password, add collaborator, etc)? In that case, an attacker would need a second one-time code.

[joshuamorton]

Normally I believe they just require the password. The threat model there is someone leaving their account logged in.

[toasterlovin]

> Normally I believe they just require the password.

Shoot, you're right. Not sure what I was thinking. My bad.