Best practice for two-factor authentication process

Question

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing the website from more than one device or IP address.

I am wondering whether giving users the option for remembering them on the different device/access profile is counterproductive to the two-factor authentication process, and if so then why would the organizations offer the option for the sake of not annoying the user? Shouldn't the user's choice to use this higher level of security imply that they are willing to go through the trouble? If anything, should they be offered an option to reduce the level of security?

Also, are there particular UX design strategies that are seen as more secure or trusted compared to other strategies? The only one I have come across so far is the verification code sent to a different email address or phone number.

Answer 1

My favourite is the 2-step verification by Google. It requires you to perform a second step of verification by entering a code after having entered your password. By default the code is required for:

• every time for any new device you're using to access your account
• every 30 days for any device you didn't mark as trusted device

The code gets generated by App on your Smartphone and it is valid for a small timespan (a minute or so). It's calculated offline, so your phone doesn't have to have an active internet connection. This is important as you might be at a desktop or in an area where you can't get internet on your phone.

Furthermore you can print out some emergency codes that can be used without the App. This is the fallback option if you don't have your phone with you (or it has run out of battery).

I've been using this 2-step verification for well over three years now, and so far it's the best two-step verification I've come across.

Answer 2

At first glance, it does seem counter-productive to allow a "remember this device" feature for two-factor authentication, however I can see why it would be useful, with relatively little impact to security¹.

Security

Firstly, any site that allows two-factor to be remembered for a particular device, is also likely to have a remember me function for those without 2FA enabled. In this case, the option to remember their 2FA details is no less secure than the user accounts who don't have 2FA enabled at all.

Secondly, the remember 2FA feature only applies to the current device that the user is using to log in with - it's not a global option. If they were to try and log in with another device, they would once again be prompted for their 2FA code. This means that if an attacker manages to obtain the username and password for a particular service (either through that service being compromised, or password re-use on a different compromised service), they will not be able to log in to the user's account unless they do it from a device that the user has previously used.

As a result, it appears that the security of the system does not get reduced by a user remembering their 2FA details the vast majority of the time. The only time it becomes an issue is when the attacker has access to a device that the user has previously used. However, having access to the device likely means they would also have access to the 2FA details anyway - a common phrase in security is if they have control of your device, you've already lost.

Usability

Normally, security comes at a cost of usability - the more secure something is, the less usable it becomes. However, we've already determined that there is little security risk to allowing 2FA details to be remembered, so we are able to relax things slightly to allow a better experience for the user.

This gain in usability is achieved by not requiring the user to enter the 2FA code every time they login. A typical scenario I see online these days (e.g. LastPass) are that the details are only remembered for 30 days, after which you are required to re-authenticate with your 2FA code once again. This then strikes a balance between security and usability, where a device is not perpetually remembered, however the user isn't having to re-authenticate every time they want to access the system.

Another strategy I have seen more and more in recent times, is allowing a user to see all of the devices on which they are currently logged in on. This feature then allows a user to logout of any/all devices, so if a device does get lost or stolen, they are able to revoke access from their account. This means that whoever has access to that device would have to re-login and re-authenticate using the 2FA details.

Conclusion

I'm not advocating that everyone should therefore remember their 2FA details on all services that they're able to. It becomes a trade-off of as to what is acceptable or not for each individual. It's likely that you wouldn't want to be remembering the details for your online banking accounts, and it's worth the reduction in usability to enter in your code every time for that additional security. However, for a social media account, the potential for harm if an attacker gained access is probably a lot lower, so that convenience of remembering the details may be worthwhile.

I've purposely left out details on the verification code itself, as I believe msp's answer is still valid today, and the Google Authenticator app (or similar) is the best way for 2FA to be implemented.

---

_{1. Disclaimer: I'm not a security expert, so there could be other potential security issues that I haven't thought of!}