MFA flow, Duo, and querying enrollment status

[Jim Fox]

>> We call Duo's API to see if a user has Duo.  It assures that we have up-to-the-
>> minute information.  It's quite simple, something like:
>
> Perfect, didn't know it would be that simple to script.
>
> You'd want to be aware that you're counting on the networking/timeout behavior of an HTTP client sitting inside Duo's code there. I'm incredibly paranoid to the point of obsession with never relying on unvetted networking code.
>

My guess is that the duo public api is about the same amount of reliable 
as the one the iframe uses.  If one's gonna fail probably the other will.

Note that the api uses a different key and secret from the iframe.

Jim