We are currently developing a registration/account creation process for our website where 2FA/MFA is the route we wish to guide all users down

There may be scenarios where a user is unable/unwilling to use the 2FA/MFA and although these are hopefully rare cases, how do other sites deal with these users creating accounts?

We have support from our helpdesk who can assist the users to get registered without the additional authentication but is the only decent UX to have a list of pre-requisites listed out to the user before they start and advise them if they are unable to use 2FA/MFA to "click here to contact helpdesk"?

  • Either 2FA/MFA is optional, or it's not. If it's not optional because of your security policies, you need to find a way to make it accessible to all users, and work on that problem.
    – Izquierdo
    Feb 25, 2022 at 14:34
  • 1
    Agreed, @Izquierdo. The unwilling aspect is sort of irrelevant. If people don't want Two-Factor Authentication because it's a "hassle", then too bad, especially if you have security policies in place that requires it. Sometimes, legally, you have to have 2FA. But the unable part is a real issue to solve. Why are they unable to do it? Because it's not accessible? That's typically why someone can't authenticate. Follow the guidelines in WCAG (w3.org/TR/WCAG21). (Even though WCAG has Web in the name, they are principles to follow for native app development too.) Feb 25, 2022 at 16:22
  • After I wrote my response, I realized that even if 2FA is optional, if users want it, calling the helpdesk for a single factor account is still an accessibility violation.
    – Izquierdo
    Feb 25, 2022 at 19:14


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.