[e12e]

It's two-factor authentication not two-factor authorization.

I'd also think that authentication was (should be) a server-side thing: and that at that point you'd get some form of session/token/ticket.

[gcr]

It already is a server-side thing.

This post shows how to steal that session/token/ticket after the authentication step.

What are you proposing?

[tlrobinson]

In that case this is no worse than stealing a cookie for a site which required 2FA, which presumably requires local access.