How can I best handle login for shared accounts with literal child users?

Question

I'm working on a website for an event organizer, who hosts events for people of all ages. The organizer is non-profit, and gets subsidies for each unique member of their organization - buying a ticket makes you a member.

To ensure that each registered member on their website is an actual person, we want to require each member to register a phone number, which must be verified by entering a code sent by SMS. [Added: In this country, you need a state-issued ID to register a phone number. We also have other reasons to require phone numbers, but it wouldn't be relevant to list them all.] Because users will also be managing their tickets and potentially pre-purchased merchandise via their account, we will require them to use Two Factor Authentication via SMS as well.

Parts of the target audience are young enough not to own a cell phone (or they have strict, old fashioned parents), and we want to offer each account holder to add "child users" for members of their own family.

What I'm wondering about is as follows;

• Since the main user (parent) will be receiving the authentication code every time someone would log in, is there any point to having a password and username for the child accounts?
• What if we ditch the authentication for the child accounts, and instead limit what they can do on the website?

Are there any best practises regarding this, and what options are available? I have thought about this a bit, but I'm no UX expert, and don't want to make a system that is "safe" but horrible to use.

Answer 1

Best practice is to make the experience work for your users. If the expectation is that there is a significant enough amount of users who won't have a phone available, then you shouldn't require a phone number on registration.

That said, attempting to be clever with registration to allow non-phone registrants to only have "child" access to the site isn't a perfect solution because there will be some (probably high) percentage of children who do have their own phones. This is something you can research based on the geographic location; here in Los Angeles kids have phones starting at age 4 but it isn't really prevalent until 10-13.

Two-factor authentication is a nice thing to have but it isn't a requirement for anything really. I used to work for a company that built software for nonprofits and most follow very lenient security protocols (which is awful), but two-factor is at the other end of the spectrum. If you simply require more stringent passwords and offer two-factor as an added feature, problem solved. Then registration is via email/social media, and a phone number can be used for added security...and since this is a nonprofit, you can even push the higher security path because npos are adamant about getting as much user data as possible.