[declnz]

But one point of the article was that he did have MFA - and it's no use in this scenario (attacker had physical access to second factor)

[mustafa_pasi]

It's not really MFA if it's all done on your phone.

[declnz]

Fair point! The article mentioned his laptop but it's unclear to me.

Aside: It's something I worry about sometimes too on phones...