> For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. Why not reauthenticate by sending a one t

> For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. Why not reauthenticate by sending a one time password by email/SMS (instead of asking for a password)? > Combo of email & SMS. Good idea. I was also thinking of sending one time passwords through some chat applications like WhatsApp, but most of them have no API for such a thing (except Telegram).