I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new t

I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new token should be generated for each separate device, but not all token providers support multiple floating tokens. It's always a battle of convinience versus security, and I get it... people think that because some services have lowered security to allow device surfing, yet without knowing the implications, that it's then just some kind of abstract non-issue taken care of by magical security things not understood. In other words it takes a big leap of faith, that was improper.