7 ms·

> reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and

> reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and then never ask again from it?

adontz 3y ago
I'd rather reask credentials before elevating effective access level. Just like sudo reasks password. I don't mean reasking MFA to access corporate intranet website with a blog no one reads, I mean reasking for administrative access.
- gnufx 3y ago
  If you want a session with extra permissions you use an appropriate Kerberos principal, e.g. admin/...
  - adontz 3y ago
    I know. This practice of having two user accounts sucks.
    - gnufx 3y ago
      Suid and ambient authority suck. I'd rather a more principalled approach.