3

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-step verification process, in particular when users are accessing the website from more than one device or IP address.

I am wondering whether giving users the option for remembering them on the different device/access profile is counterproductive to the two-step verification process, and if so then why would the organizations offer the option for the sake of not annoying the user? Shouldn't the user's choice to use this higher level of security imply that they are willing to go through the trouble? If anything, should they be offered an option to reduce the level of security?

Also, are there particular UX design strategies that are seen as more secure or trusted compared to other strategies? The only one I have come across so far is the verification code sent to a different email address or phone number.

1

My favourite is the 2-step verification by Google. It requires you to perform a second step of verification by entering a code after having entered your password. By default the code is required for:

  • every time for any new device you're using to access your account
  • every 30 days for any device you didn't mark as trusted device

The code gets generated by App on your Smartphone and it is valid for a small timespan (a minute or so). It's calculated offline, so your phone doesn't have to have an active internet connection. This is important as you might be at a desktop or in an area where you can't get internet on your phone.

Furthermore you can print out some emergency codes that can be used without the App. This is the fallback option if you don't have your phone with you (or it has run out of battery).

I've been using this 2-step verification for well over three years now, and so far it's the best two-step verification I've come across.

  • 1
    Seconded. However, Google's method is more for the average internet user. If the target is for corporations with a significant security risk, there should not be a "skip verification for this device" option. – mrchaarlie Aug 1 '14 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.