> Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.
Can you explain this a little more? I don't think I understand, because to me it sounds like you're saying, "once your account is hacked, two factor authentication won't help because your account has been hacked, so the adversary can disable two factor authentication". Don't major changes to accounts like that sometimes require re-authenticating with all required factors? I need to do this if I want to add a bill pay recipient to my bank account even if I'm already logged in.
Can you explain this a little more? I don't think I understand, because to me it sounds like you're saying, "once your account is hacked, two factor authentication won't help because your account has been hacked, so the adversary can disable two factor authentication". Don't major changes to accounts like that sometimes require re-authenticating with all required factors? I need to do this if I want to add a bill pay recipient to my bank account even if I'm already logged in.