FREQUENT REAUTH DOESN'T MAKE YOU MORE SECURE

Summary from the TLDR InfoSec newsletter

Low session expiration times frustrate users and don't effectively improve security. Frequent reauthentication aims to prevent credential theft, but if attackers have physical access, a screen lock suffices, and if remote, expiration times are often too long to prevent breaches. Instead, systems should reauthenticate only before sensitive actions and use continuous verification like device checks and SCIM controls.