Two Factor Authentication (2FA) - Does this impair experience?

Question

One of our products that we have built in our workplace is a dashboard where users can view their "big data", visually and broken down into digestible chunks.

Recently, it has been suggested in a meeting to add two factor authentication - much to the alarm of the front-end developers in a meeting. The main argument here was that it was currently unnecessary, and that the user experience of the product would be greatly degraded by users who log in to the dashboard daily to view their data. It was also argued that third-party (federation identity management) was a good enough solution?

My question to you is in what circumstances do you feel that 2FA is necessary? How much of a burden on the user is 2FA, and if it's implemented as a feature - should this always be optional?

Answer 1

2FA is realistically necessary everywhere, but as your front-end developers have said it does not always benefit the end user in terms of user experience. The tricky thing about 2FA is that a user is better protected with it, however it requires extra effort from your user to acquire this protection, some users feel this is a massive burden. This is a lot of the reason why big sites will let you have the option to enable/disable 2FA, people like instant gratification and logging into a site can be tedious hense why so many people autofill their usernames and passwords.

Maybe instead of forcing 2FA, you implement it in a similar way to Steam? I can log in normally everytime I visit, as soon as I visit on a different machine, it requires me to verify with my phone or my email. This is really clever, I am not forced to use it, yet I feel protected when I change my behaviour.