Authentication frequency for polling system

Question

I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand!

We are using two factor authentication so the user will be asked to supply a user name, a password and an authentication code which will be sent to their phone (or similar)

We're having arguments about how often to ask for the authentication code. I say at first login, another option is at every login, a final option is at every transaction during a logged in session.

I think the last option is ridiculous but my question is: is there any established patterns or evidence to suggest which is the best trade off between usability and security in terms of how often to ask for the authorisation code?

Since elections are rare events, I assume user will only be logging in a few times, maybe even once.

Answer 1

As security is a major concern in this platform, it's always best to err on the side of caution. However, you also want to be careful not to encumber the application with constant requests for authentication. Although it's arguably more secure to keep asking for proof of identity for every action, it rapidly devolves into a bad user experience.

Two-factor authentication only remains secure for as long as you can guarantee that the user is who they say they are. If someone is accessing your platform from a trusted device (for instance, their home PC), only requiring secondary authentication at first login is likely safe. However, if your users are accessing public terminals of some sort (kiosks, libraries, etc), then secondary authentication should be required at every login.

The strongest approach to two-factor authentication from a UX standpoint (read: NOT security) is to require the user to use secondary authentication on first login and allow them to choose their own level of security going forward. In most platforms a secure login up front is not feasible, but it sounds like it is in the case of your platform.

Answer 2

If you really want a great deal of security for your transactions, you should probably do it like banks (I heard they are very security concious ;-)

So the User logs in with his username + password, then he proceeds to do his various transactions - when he wants to commit his transactions to the system, he has to verify the transaction with an authentication code on his phone. He will get a new code for every transaction and you can even supply a summary with the code. This will prevent most forms of phishing or forgery.