Reason why it is not recommended requiring a second factor during reauthentication?

[ankoro73]

12 We do not recommend that relying parties require a second factor during reauthentication. Instead, you should see whether the user's platform features a user-verifying FIDO platform authenticator, and employ it, making reauthentication more user-friendly without sacrificing security.

Why "We do not recommend that relying parties require a second factor during reauthentication"?
I think you should explain the reason why you make this recommendation.

[sbweeden]

I find that the current text self-explains why the recommendation is made. When a user-verifying platform authenticator is employed for reauthentication, the user experience is user-friendly without sacrificing security. If you have a suggested re-word, could you please submit a PR. If after re-reading the above explanation you think that a re-word is not necessary, perhaps close the issue?

[maxhata]

Once they register a roaming authenticator, users can now secure their bootstrap sign-ins by using this authenticator as a 2nd-factor during sign-in.[12]

[12] We do not recommend that relying parties require a second factor during reauthentication. Instead, you should see whether the user's platform features a user-verifying FIDO platform authenticator, and employ it, making reauthentication more user-friendly without sacrificing security.

It is still not clear to me what "We do not recommend that relying parties require a second factor during reauthentication." wants to say.

Does it want to say "We do not recommend that relying parties require a second factor during reauthentication using the roaming authenticator"?

So does it want to recommend to use UVPA instead of the UVRA if UVPA is available for better usability?

[christiaanbrand]

It's more generic than that: We mean to say - relying parties shouldn't ask for a fingerprint during reauthentication, and then also go on to ask for other types of second factors (like SMS OTP 2-FA, etc). A FIDO authentication should be enough to satisfy both the physical possession and user verification factors.

[maxhata]

#24