0

I have a question regarding UX of the 2nd factor authentication (2FA) process.

It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for the 2FA.

I understand that this is useful and necessary for email and sms based solutions.

But why not ask, in the login page, for the code when it is app based solution (Authenticator, Google Authenticator, etc…)?

In the login page it would have 3 fields

  • Email
  • Password
  • 2FA code
6
  • Do you mean showing the 2FA Code field after the user authenticates with Email and Password, but staying on the same form instead of going to another screen?
    – Izquierdo
    Sep 7 at 17:48
  • User is required to enter email, password and 2FA code to proceed. The 3 on the same screen, as one step.
    – lcssanches
    Sep 7 at 18:06
  • How does the system know who the user is?
    – Izquierdo
    Sep 7 at 18:36
  • Basically email, password and 2FA code would be sent in the same http request to the backend. If email and password are correct, we check for the 2FA.
    – lcssanches
    Sep 7 at 18:41
  • 1
    How does the user get the 2FA code before the system knows who they are?
    – Izquierdo
    Sep 7 at 18:44
5

Reasons I could think of why 2FA is on a separate page:

Sense of security

If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will perceive a separate 2FA page as more secure then if it is just another field on the login page.

Consistency with other 2FA methods (email, sms)

It is easier to make the design work for multiple 2FA methods that way. The first page will always show username/password, the second page will contain the input fields for 2FA.

2
  • 1
    I think this is the correct answer. Can't think of any other reason. You might want to illustrate on the second point though. Sep 8 at 5:42
  • This seams to be pretty much the most correct answer to this date. The consistency and compatibility of the design-system with multiple 2FA methods is important for your business and for the users. Less barriers to learn new paths.
    – marvinpoo
    Sep 8 at 8:27
1

Not all systems require 2FA. Although requiring 2FA seems to be growing in popularity, there are many login forms where it has been added after the fact.

A login form is presented prior to knowing anything about the user. Showing a 2FA prompt to them prior to knowing that they have 2FA enabled will likely result in confusion.

Going even further, some login pages break up the flow into multiple steps, prompting for email, password, and 2FA one at a time. This could be further beneficial because the user may be required to make choices about their 2FA factor: using an SMS prompt, hardware security key, or email confirmation (to name a few) based on the situation the user finds themselves in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.