Trusted devices are a convenience control, not a recovery plan.

What a trusted device actually is

Trusting a device does not turn off the account second factor — it remembers that a specific browser already passed the challenge, so it can skip the prompt for a limited window. The marker is a token stored in that browser; Awthy keeps only a hashed copy, sets an expiry, and records the event so it shows up in audit history. That last part matters: a trust that nobody can see or revoke is just a quieter password.

Use trust sparingly

The failure mode is treating "remembered" as "safe forever." A trusted device on a shared back-office computer, a sold laptop, or a departed staff member browser is an open door that never prompted again. Keep the trust window short enough that an abandoned device ages out on its own, and make revoking a device a one-click action your team actually knows how to use, not a setting buried three menus deep.

Operational checks before you reduce prompts

• Make device trust easy to revoke after a lost laptop or a staff departure.
• Set the expiry and re-verification window before you reduce how often the challenge fires.
• Keep support from ever asking for raw cookies, tokens, codes, or secrets.
• Review remembered-device behavior on staff before considering any customer-wide enforcement.
• Do not let a trusted device stand in for a real recovery plan.

What trusted devices are not

A trusted device says "this browser cleared the challenge recently." It says nothing about whether the machine is patched, malware-free, or still in the right hands. Trusted devices are not endpoint security, device management, or malware protection, and they are not a substitute for recovery. Treat them as a friction control with an expiry date, keep paid or release-verified trusted-device claims out of free-feature copy, and let recovery and audit carry the weight they are actually built for.