The sweet smell of session cookies: how easy it is for hackers to crack 2FA