2

We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most users don't perceive 2FA as added security but as an annoyance.

While having 2FA is undeniably more secure than not having it, the question arises: from a user expectation perspective, can a process using 2FA truly be considered secure if users don't view it as such?


Note: While this question focuses on 2FA, it can be framed in broader terms: Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

5
  • 1
    I think you could be looking at a combination of the placebo and the nocebo effects here, where if a process is not perceived as such, then the users might not follow it (or do it poorly if forced, e.g. password requirements), and if a process is perceived as secure then they also might rely on it too much and not employ a more holistic approach to security. Human psychology is difficult to anticipate and design for, and human behaviour evolves. I would say that there isn't a definitive answer to this.
    – Michael Lai
    Commented Sep 20, 2023 at 22:57
  • well, for some reason this was closed so I got an answer using ChatGPT with a perfect non-opiinonated justification based on UX rules :D (btw, the answer is YES for the first question and NO for the second more generic question)
    – Devin
    Commented Sep 21, 2023 at 1:59
  • 1
    Upps, me experience with the factuality of ChatGPT answers (of which I have seen very few) does not make me believe either the Yes or the No :-) Commented Sep 21, 2023 at 8:05
  • yes, well... that's why I asked for justification and could verify the answer is correct according to accepted UX paradigms.
    – Devin
    Commented Sep 21, 2023 at 14:02
  • 1
    @Devin if you believe that there is an objective answer to the question, perhaps you would like to paraphrase what ChatGPT has provided since I have reopened the question? In a way, it would probably be preferable to push questions that can be answered by ChatGPT over there, and leave the questions that require more contextual interpretation by people on UXSE.
    – Michael Lai
    Commented Sep 21, 2023 at 22:58

2 Answers 2

1

Note: While this question focuses on 2FA, it can be framed in broader terms: Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

It is true that if a feature is not perceived as a feature by a person, it is missing the affordance for that person. That means that that person will consider that feature to be non-existent.

But security is not an affordance, but the fact that you can enter your login details to get to your account is. Logging in is never a goal of a user, it's a necessary step to get to the goal. The actual goal is behind the security steps, on the account page of the user. And when you add an extra step it is only an extra distraction from that goal. We people have a very limited short-term memory and 2FA adds a few dangerously distracting actions to the login process: If you're not already working on your mobile, you'll need to pick that up first, then you have to open the authentication app and copy the code over or remember it and type it in elsewhere. It's probably more effort than most people are willing to do. And most people won't even understand why it's needed or why it makes the application more secure. But that misunderstanding doesn't make the application less secure.

The bottom line is that you don’t “use” security. It’s just there. If 2FA is proven to be more secure but people don’t perceive it as such, the feature of added security may not be there for them. But the application (or process) using 2FA can still be considered (and is still proven) to be secure. If 2FA is what you want to protect people’s accounts, you just need to find a more convincing way to sell it.

2
  • Yes, that's correct, maybe I should have worded it in a different way, my angle was the research we did where people considered security (in that part I slightly disagree with you: not everybody, but people perceive security and it usually is a selling point by companies) as an annoyance rather than something that helps them.
    – Devin
    Commented Sep 26, 2023 at 16:20
  • 1
    My answer was missing a bottom line. Added.
    – jazZRo
    Commented Sep 26, 2023 at 22:02
2

Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

While the specific question can't really be answered with specific details, the broader question of whether a feature can be perceived as possessing that feature even if the users don't acknowledge it is probably yes.

An example would be the captcha mechanism employed by websites to try and eliminate or minimize bots interacting with the content. Even if the users don't acknowledge that it is effective at validating human users, it does to some extent reduce the amount of bots crawling, scraping or submitting data on websites. And because the technology of captcha keeps improving and changing, there is always constant debate about whether the technology of validating human users is keeping up with the technology of bots that can impersonate human users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.