The login ceremony gets hardware keys and biometrics. Everything after it rides on a cookie. The session, not the password, is where takeover happens now.
