## Chapter 11 — The password-only window is twelve minutes ### Learning outcomes After this chapter, you should be able to: 1. Subtract each recorded pair. 2. Name which pair is the password-only window. 3. Leave the earlier wording in place while using the clocks. ### 11.1 Twelve belongs to revocation and MFA. Eleven belongs to reset and MFA. The Monday log records five times. Leo approved at 10:05. BrightPath revoked Elaine's sessions at 10:08. The password was reset at 10:09. The rule was removed at 10:11. MFA was enabled at 10:20 after Elaine set up the authenticator on her phone. The playbook order stays sign out, reset, remove the rule, turn on MFA, then review sent items and rules. This chapter does not reorder those steps. Subtraction is the mechanism. `10:08 - 10:05` is three minutes, the wait from approval to revocation. `10:20 - 10:08` is twelve minutes. During those twelve minutes the old sessions were gone and MFA was not on yet, so the new password was the only block. That is the password-only window. `10:20 - 10:09` is eleven minutes, and eleven counts only from the reset to MFA. `10:20 - 10:05` is fifteen minutes, from approval to MFA, which is the full sequence already stated and is not the password-only window. Section 3.2 says "In the eleven minutes between revoking sessions and enabling MFA". Revocation is the 10:08 clock, and MFA is the 10:20 clock. Those two clocks differ by twelve, not by eleven. Eleven is the neighbouring pair, reset to MFA. This chapter does not edit that sentence. A reader who names the clocks can see which pair was subtracted. The app still takes a few minutes, which is why MFA sits at 10:20 rather than at 10:09. The rule still comes off at 10:11, before the sent-items review, so later replies are not forwarded while that review happens. | Pair | Minutes | Question it answers | |---|---|---| | 10:05 to 10:08 | 3 | Approval to revocation | | 10:08 to 10:20 | 12 | Password-only window | | 10:09 to 10:20 | 11 | Reset to MFA only | | 10:05 to 10:20 | 15 | Approval to MFA | ### 11.2 Worked example | Offered window | Clocks used | Decision | |---|---|---| | Twelve minutes | 10:08 and 10:20 | Keep, as the password-only window | | Eleven minutes | 10:09 and 10:20 | Keep, labelled as reset-to-MFA | | "Revocation to MFA was eleven." | Those clocks differ by twelve | Refuse | | "Approval to MFA was the password-only window." | That pair is fifteen | Refuse | > **Synthetic case.** The five log times stay the only Monday clocks. ### Errors and limits Do not rewrite section 3.2 in order to hide the mismatched pair. ### Apply - **EX057 — Four differences.** What is 10:20 minus 10:08, what is 10:20 minus 10:09, and which difference is the password-only window? *Rubric:* 3 = twelve minutes from revocation to MFA; eleven minutes from reset to MFA; the password-only window is the twelve; fifteen is approval to MFA;; 2 = twelve and eleven stay on the correct pairs;; 1 = one difference;; 0 = none. ### Continue studying — lesson 11 (chapter 11 of 20) [← Chapter 10](#ch-10) · [Course chapter index](../SUBJECTS.md) · [Chapter 12 →](#ch-12) Continue to the next authored lesson. ## Worked answers **EX057.** 10:20 minus 10:08 is twelve minutes, and that pair is the password-only window. 10:20 minus 10:09 is eleven minutes, from the reset to MFA. Approval to MFA is fifteen minutes.