Bug 1000323 - Force reauthentication when disabling Find My Device.

Why should it remain disabled? When would we re-enable it?

The way I see it, we should re-enable the checkbox when forceAuth is canceled to give the user the opportunity to attempt to disable FMD later, and of course that would once again require a forceAuth. I'm assuming here that, if the user is not logged in to FxA at all, a forceAuth is equivalent to a login for our purposes -- if you were previously not logged in, but can prove through forceAuth that you are the same person who enabled FMD, then it's fine for you to disable it. Please let me know if I'm off the mark here.

Perhaps what you're thinking is that we should just disable the checkbox on logout, and re-enable it on login, so that FMD is effectively locked while the user is logged out of FxA? That would also make sense I think, but the user experience for when you're not logged in and want to disable FMD is poorer: you'd have to go back to Settings, log in to FxA to unlock FMD, then disable.