Passwordless track · 3 min
Step-up before the risky click
Stay signed in for routine work, re-check at the sensitive moment.
The idea
1A session ages
A person signs in at nine. By afternoon, that proof says little about who is at the keyboard now.
2Step-up asks again at the sensitive moment
AuthMantra asks admins to re-authenticate before sensitive admin actions, even with a session already open.
3Be selective
If every click asks, people learn to click through. Reserve it for actions you would want proof of later.
4Pick a rhythm people can live with
The trade-off is exposure against interruptions. Move the slider to see it.
Try it
A policy slider: how fresh must the proof be?
A general trade-off, not a product setting. Drag the slider.
This exercise needs JavaScript. Here is the answer key.
| Freshness | Prompts | Exposure | Effect |
|---|---|---|---|
| Every time | 6 prompts | Nothing beyond one action | Fatigue: people approve without reading. |
| 1 minute | 5 prompts | About a minute | Tight, but noisy during a task. |
| 5 minutes | 3 prompts | A few minutes | A common balance for admin tasks. |
| 15 minutes | 2 prompts | A quarter of an hour | Fewer prompts, longer exposure. |
| 1 hour | 1 prompt | An hour | Quiet, but a hijacked session has time. |
| Whole session | 0 prompts | The whole working day | No second check at all. |
Check yourself
1 of 3 What does step-up protect against best?
2 of 3 Why not ask at every click?
3 of 3 Which action deserves a re-check?
Answer key
- What does step-up protect against best? Someone using an already open session. A fresh proof is required at the sensitive moment.
- Why not ask at every click? People start approving without thinking. Prompt fatigue weakens the check.
- Which action deserves a re-check? Exporting the full user list. Bulk personal data is sensitive.