0

I need to implement a reset password feature with MFA. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.

I think the order of these should be answer qs---> send code ---> create new password. But our current wireframe has send code --> answer the qs ---> create new password.

Thoughts?

Improve this question
2
  • 1
    My impression is that this would be about the same user experience either way. However, you might get stronger opinions and other valuable perspectives from the people over at Information Security.
    – maxathousand
    Commented Apr 13, 2018 at 20:12
  • I was going to comment about how this was just a question of ordering and not something for the Security exchange but I'm not so sure now. The secure part of this transaction is sending out the email - It's direct from one machine to another. Once the code is received, things move into the human domain and get a bit dicey - the email can be forwarded, the code can be duplicated, etc. So, on the return from there, it's wise to check that the person using the code is the person who should be using it and we can do that by asking the security questions.
    – Roux Martin
    Commented Sep 11, 2018 at 7:37

1 Answer 1

Reset to default
1

For a user trying to recover an account they think they own is more convenient if the questions are first; they should recognize the questions, or at least recognize if their correct answers were flagged as incorrect. For a user trying to keep their account secure, they would probably prefer a verification code first, since that effectively notifies them of attempts to access their account. Which is preferred? It likely depends on who you ask. I personally would follow the commented advice and ask on Security for the pros and cons of each. The actual experience to a legitimate user trying to access their account is relatively minimal, assuming you're going to require both steps anyways.

Improve this answer
1
  • Surely this is still the case with an email first situation - If the user enters an email address that's not associated with any account then the system should be able to flag that and report it back to the user - Something like "I don't recognise that email address" which could also be followed up with a sign-up suggestion. This is much more user friendly than asking them to recognise questions or get a failure notice on answers they KNOW are correct.
    – Roux Martin
    Commented Sep 11, 2018 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.