Default value of 10 days is too long in some market

[bigludo7]

Problem description
10 days is a bit too much for some legal officiers and for example in France in my company the DPO request was to reduce to 7.
So I have a trouble with a default max age that will trigger an error

Possible evolution

• Reduce the maxAge to a smaller value? 7? 3?

Alternative solution

• Remove the default value but I'm absolutely not fan of this as it is a breaking change

Additional context

[yyeAduna]

Smaller maxAge makes sense. It will reduce false positive rate significantly. When it is used for bank fraud prevention, the FIs are usually willing to sacrifice the detection rate to lower false positive rate. 4 (or 8) seem to be a good default number based on my experience that keeps a good balance between those two Key Performance Measurements.

[HuubAppelboom]

@bigludo7 @yyeAduna This is still a default value , not ? So a bank can always decide to deviate from this ?

I don't see how this will impact privacy significantly, btw. It has more impact on the number of false posities.

[bigludo7]

Thanks @yyeAduna and @HuubAppelboom for feedback

Yes Huub this is default value but my point was that I'm bit concerned that the default value was not allowed in some region... That why I proposed to reduce it to 3 days. Any objection from the team for a change from 10 to 3?

[HuubAppelboom]

@bigludo7 No problem here, most customers I see use 3 days anyway.

[jpengar]

From Telefónica's perspective, it doesn't seem like much of a problem. The only issue is that changing the default value from 10 days to 3 days could be considered a non-backwards compatible change. If a client uses the default and expects SIM swaps within 10 days, but it is now 3 days, it could lead to errors. If it is considered a breaking change, it would require a new major release. The issue is determining how critical this risk is in order to make that change without moving to a new major release.

[bigludo7]

Thanks @jpengar
Make sense !
I'm a bit uncomfortable to propose a new major version for this 'small' update. Let's keep it for a future release when we will have other stuff requiring major version change.