I'm working on a website for an event organizer, who hosts events for people of all ages. The organizer is non-profit, and gets subsidies for each unique member of their organization - buying a ticket makes you a member.
To ensure that each registered member on their website is an actual person, we want to require each member to register a phone number, which must be verified by entering a code sent by SMS. [Added: In this country, you need a state-issued ID to register a phone number. We also have other reasons to require phone numbers, but it wouldn't be relevant to list them all.] Because users will also be managing their tickets and potentially pre-purchased merchandise via their account, we will require them to use Two Factor Authentication via SMS as well.
Parts of the target audience are young enough not to own a cell phone (or they have strict, old fashioned parents), and we want to offer each account holder to add "child users" for members of their own family.
What I'm wondering about is as follows;
- Since the main user (parent) will be receiving the authentication code every time someone would log in, is there any point to having a password and username for the child accounts?
- What if we ditch the authentication for the child accounts, and instead limit what they can do on the website?
Are there any best practises regarding this, and what options are available? I have thought about this a bit, but I'm no UX expert, and don't want to make a system that is "safe" but horrible to use.