Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already logged in.
GitHub uses for this reason the user's password. I wonder if this is the best approach. Why should I use the password and not the one time password provided by an authenticator like Google Authenticator? Would that not be more secure? Especially, most browsers save the password and provide them in the password field while the one time password can not be provided per design?