30 days, for example, is quite long, though NIST does identify 30 days as being the maximum recommended auth token lifetime for low-risk environments.

Higher-risk environments come with 24-hour and 15-minute lifetimes, for context.

What technical reason is there?

> Because when you log in you don’t want to be logged out at (what, for you, will appear to be) a random time of the future.

> That’s a solution for a problem that doesn’t exist. Nobody considers not getting logged out randomly a problem.

Isn’t this contradictory? The double negatives are really throwing me for a loop. Regardless, it’s extremely common for you to be force-logged out of a session for any portal that has sensitive info.

You’re never logged into your bank forever, SSO logins expire. The ones that don’t expire are stuff like YouTube or Netflix, but only if you use it (length of refresh token validity). Checkbox for keeping a session valid is a legitimate solution and I’m grateful it exists. Why do you say it’s a problem that doesn’t exist, when you yourself said it does?

I do not understand your thesis.

We make many UX compromises in the name of security, and this is a place where that is most visible.