STOLEN SESSION COOKIES DON'T CARE ABOUT YOUR MFA

Summary from the TLDR InfoSec newsletter

Attackers no longer need passwords. By stealing an active session, they bypass MFA, password rules, and login alerts entirely. Fingerprint catches what authentication can't see: → A persistent device identifier ties every session to the device behind it, so a stolen token replayed from unfamiliar hardware stands out instantly. → A single risk score rolls 20+ Smart Signals (Residential Proxy Detection, Browser Tampering, Virtual Machine Detection, and more) into one easy-to-use risk number. → Hijacked sessions get caught without adding friction for legitimate users.