Re:Frequent reauth doesn't make you more secure
by blueflow on Friday June 13, 2025 @05:46AM
(#44267103)
This can be done at login time without the user noticing, as you have the plaintext password for a moment.
[ Parent
| on HN ]
Re:Frequent reauth doesn't make you more secure
by mooreds on Friday June 13, 2025 @10:13AM
(#44268711)
Yeah, this is the best practice. We offer that in our product.
But it's possible that you could follow the best practice and still force a reset. This could be because:
* the customer or provider doesn't want to wait for everyone to log in
* they've waited for N months and now there is a block of users who have not logged in yet and they think it is worth the user annoyance to just force them all to reset their password