&gt; What do you mean by privileged elevation (I&#x27;m talking in the context of a web app)?<p>For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session.<p>&gt; I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)?<p>Combo of email &amp; SMS.<p>As Bruce Schneier has written, security is usually a trade off of user experience.