4 ms·

In many cases, a typical cookie / session expiration time is enough time to heavily compromise an account / product / org.

• bkettle 3y ago
  Maybe once we replace passwords with FIDO2 more widely and people no longer have to remember and enter their password every time they manually authenticate, we can shorten up session timeouts. Or, as GitHub does, we can require explicit authentication for sensitive actions. But yes, agreed—there’s not much FIDO2 can do to help when authentication isn’t required.
  • leetbulb 3y ago
    Agreed. </3 passwords. Excellent work by the way. This stuff is super intriguing.
  • deleted 3y ago
    [deleted]