Comment on Researchers reverse-engineer the Dropbox client: What it meansparentComments−e12e13yIt's two-factor authentication not two-factor authorization.I'd also think that authentication was (should be) a server-side thing: and that at that point you'd get some form of session/token/ticket.−gcr13yIt already is a server-side thing.This post shows how to steal that session/token/ticket after the authentication step.What are you proposing?−tlrobinson13yIn that case this is no worse than stealing a cookie for a site which required 2FA, which presumably requires local access.
Comments
It's two-factor authentication not two-factor authorization.
I'd also think that authentication was (should be) a server-side thing: and that at that point you'd get some form of session/token/ticket.
It already is a server-side thing.
This post shows how to steal that session/token/ticket after the authentication step.
What are you proposing?
In that case this is no worse than stealing a cookie for a site which required 2FA, which presumably requires local access.