That's a cool idea for a web service where once someone tries to actually change something, you can ask again for the password. I struggle to see how it makes a

That's a cool idea for a web service where once someone tries to actually change something, you can ask again for the password. I struggle to see how it makes any sort of difference for a remote management software; it's essentially an enterprise ready trojan. The moment someone has connected to a machine through token or password, that machine is utterly compromised and can not be saved by you clicking "revoke" in a web interface. That kinda situation calls for you to physically disconnect the machine from power.