I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand!
We are using two factor authentication so the user will be asked to supply a user name, a password and an authentication code which will be sent to their phone (or similar)
We're having arguments about how often to ask for the authentication code. I say at first login, another option is at every login, a final option is at every transaction during a logged in session.
I think the last option is ridiculous but my question is: is there any established patterns or evidence to suggest which is the best trade off between usability and security in terms of how often to ask for the authorisation code?
Since elections are rare events, I assume user will only be logging in a few times, maybe even once.