One of our products that we have built in our workplace is a dashboard where users can view their "big data", visually and broken down into digestible chunks.
Recently, it has been suggested in a meeting to add two factor authentication - much to the alarm of the front-end developers in a meeting. The main argument here was that it was currently unnecessary, and that the user experience of the product would be greatly degraded by users who log in to the dashboard daily to view their data. It was also argued that third-party (federation identity management) was a good enough solution?
My question to you is in what circumstances do you feel that 2FA is necessary? How much of a burden on the user is 2FA, and if it's implemented as a feature - should this always be optional?