Comment by sublinear

This is precisely why it's constantly argued that a phone is not a good 2nd factor for authentication. The auth data should be on a device that is basically worthless except for the data it holds which in turn is also inaccessible to someone else.

Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.