[tlrobinson]

In that case this is no worse than stealing a cookie for a site which required 2FA, which presumably requires local access.