[gcr]

It already is a server-side thing.

This post shows how to steal that session/token/ticket after the authentication step.

What are you proposing?

[tlrobinson]

In that case this is no worse than stealing a cookie for a site which required 2FA, which presumably requires local access.