4 ms·
* Re-auth across devices: you can't typically exchange a session for another session on a different device, but you sure can do so with a password. Ever had Go
by megous 5y ago
* Re-auth across devices: you can't typically exchange a session for another session on a different device, but you sure can do so with a password.
Ever had Google deny you access for a perfectly valid username/password combo when loging in from "unfamiliar" location? :) Or a bank ask you for SMS code when logging in from a different browser?
It really depends on level of paranoia of the authentication system. You can have user device validation even with username/password, and you may not have it for session IDs in a different implementation.
- mooreds 5y agoThat's a fair point. I guess I was speaking in the more general case, but yes, you can have multiple layers of authentication and it is super implementation dependent. Everyone has their own threat model (hopefully!). (I wrote a few thousand words on MFA a year or so ago: https://fusionauth.io/learn/expert-advice/authentication/multi-factor-authentication https://fusionauth.io/learn/expert-advice/authentication/mul... )