UX for common applications is poor. Would you want to have to enter your email password every hour or two, for instance? I’d argue for truly critical infrastr

UX for common applications is poor. Would you want to have to enter your email password every hour or two, for instance? I’d argue for truly critical infrastructure, short-ish session times can be useful, but for most applications they do more harm than good and better alternatives exist. For instance: * Enforcing step-up authentication for access to sensitive application functions. * Forcing re-auth based on behavioral analytics (for instance, if the user normally accesses an app 8 - 5 Monday - Friday from the United States, but presents a session token on Saturday afternoon from Russia, maybe force a reauth.) * For enterprise apps, SSO where you may be forcing an authentication event every shift, but at least it is one, not one per app. But, of course, there is no one right answer because there is no universally applicable or agreed upon threat model.