3 ms·
> What do you mean by privileged elevation (I'm talking in the context of a web app)? For example, prior to changing account settings, reauthenticate the users
by balls187 11y ago
> What do you mean by privileged elevation (I'm talking in the context of a web app)?
For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session.
> I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)?
Combo of email & SMS.
As Bruce Schneier has written, security is usually a trade off of user experience.
- ngrilly 11y ago> For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. Why not reauthenticate by sending a one time password by email/SMS (instead of asking for a password)? > Combo of email & SMS. Good idea. I was also thinking of sending one time passwords through some chat applications like WhatsApp, but most of them have no API for such a thing (except Telegram).
- ngrilly 11y ago> Combo of email & SMS In France, where I have most of my customers, the SMS is paid by the sender, which makes it expensive.