My company has an external auth provider for the whole organization, and MFA is required (push notification to a phone app). This all works well and I agree with it, BUT they have configured the credentials to expire in 20 minutes. In practice this means everyone in the company is typing their password and fiddling with their phone dozens of times per day to work with any application except for email (somehow it gets away with caching the credentials).
Timeouts for credentials are good, but does this aggressively low setting actually provide increased security?
This whole reply strongly agrees with my own personal bias, but I wanted to ask the question just in case I’d talked myself into a position when really 20-minute windows was somehow psychologically better. I just couldn’t fathom how, and glad to hear my initial “wtf” position seems to be the correct one.