I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field?

One of my concerns is that non tech savvy users may get lost or confused if they would have to switch between my app and the app generation one time password.


  • I suggest you also consult Information Security's multi-factor tag, (opinion) as 2FA systems are widely misunderstood (/opinion).
    – msanford
    Commented Jan 30, 2018 at 19:56
  • If they switch between your app and the authenticator app you're not using two factors. The second factor is a second factor because it is on another device.
    – allo
    Commented Jan 31, 2018 at 15:38
  • @allo that isn't entirely correct. Multi factors can be provided through the same device. Soft tokens are often installed on PCs that are used to provide a second key after a password is used. Some factors of authentication are what you have, what you know, where you are, who you are. Thus providing a second factor on the same device you're authenticating from is not an issue. Commented Aug 7, 2018 at 20:31

1 Answer 1


There are four main types of 2FA in common use by consumer websites:


When you enable a site's SMS 2FA option, you'll often be asked to provide a phone number. Next time you log in with your username and password, you'll also be asked to enter a short code (typically 5-6 digits) that gets texted to your phone. This is a very popular option for sites to implement, since many people have an SMS-capable phone number and it doesn't require installing an app. It provides a significant step up in account security relative to just a username and password. enter image description here

Authenticator App / TOTP 2FA

Another phone-based option for 2FA is to use an application that generates codes locally based on a secret key. Google Authenticator is a very popular application for this; FreeOTP is a free software alternative. The underlying technology for this style of 2FA is called Time-Based One Time Password (TOTP), and is part of the Open Authentication (OATH) architecture (not to be confused with OAuth, the technology behind "Log in with Facebook" and "Log in with Twitter" buttons). enter image description here

True two-factor authentication

For something to be considered a true 2FA system, it needs two components that operate independently and avoid a common point of compromise.

Common implementations of this are smart cards, login tokens such as the RSA SecurID, and Yubikeys.

Smartcards require a special reader to communicate with the chip on the card, but that chip acts as a tiny standalone computer with its own CPU, secure memory and cryptographic capability.

enter image description here

Push-based 2FA

Some systems, like Duo Push and Apple's Trusted Devices method, can send a prompt to one of your devices during login. This prompt will indicate that someone (possibly you) is trying to log in, and an estimated location for the login attempt. You can then approve or deny the attempt.

This style of 2FA improves on authenticator apps in two ways: Acknowledging the prompt is slightly more convenient than typing in a code, and it is somewhat more resistant to phishing. With SMS and authenticator apps, a phishing site can simply ask for your code in addition to your password, and pass that code along to the legitimate site when logging in as you. Because push-based 2FA generally displays an estimated location based on the IP address from which a login was originated, and most phishing attacks don't happen to be operated from the same IP address ranges as their victims, you may be able to spot a phishing attack in progress by noticing that the estimated location differs from your actual location. However, this requires that you pay close attention to a subtle security indicator. And since location is only estimated, it's tempting to ignore any anomalies. So the additional phishing protection provided by push-based 2FA is limited.

1. https://www.eff.org/deeplinks/2017/09/guide-common-types-two-factor-authentication-web
2. https://medium.com/@4Barel/ux-vs-cybersecurity-3eedf77ed6e7
3. https://www.confirm.io/blog/beyond-two-factor-authentication-


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.