Thankfully their new 2FA actually looks decent, although presumably you could just go after a known user's already-authorized client device for easy and profitable lulz/great justice.