Do you have any similar requirements in Michigan and if so, how have
you addressed them?
Very. So far, two cases have been brought to our attention. First is
similar to the one you describe. Our plan is to add a cosign server
option to indicate that a site requires a password for each
registration event. This allows the site to dictate a local idle
timeout. Correspondingly, it will allow sites that don't care as much
to have very large idle timeouts, without negatively impacting the
security of these re-register sites.
The second case, brought by our finance people, is for multi-factor
authentication.
