Timeline for How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 21 at 16:08 | comment | added | Ja1024 | Does the session ID stay the same after the re-authentication? Usually, it's changed, so that an attacker doesn't get access to the privileged session. | |
| Jun 21 at 13:50 | vote | accept | Yami Odymel | ||
| Jun 21 at 13:50 | comment | added | Yami Odymel | GitHub promotes the session after I re-enter the password, so the attacker would also get a promoted session if the session was hijacked. But yeah, it looks like a user problem; websites have already done their best. | |
| Jun 21 at 4:33 | history | answered | Ja1024 | CC BY-SA 4.0 |