2

One of our products that we have built in our workplace is a dashboard where users can view their "big data", visually and broken down into digestible chunks.

Recently, it has been suggested in a meeting to add two factor authentication - much to the alarm of the front-end developers in a meeting. The main argument here was that it was currently unnecessary, and that the user experience of the product would be greatly degraded by users who log in to the dashboard daily to view their data. It was also argued that third-party (federation identity management) was a good enough solution?

My question to you is in what circumstances do you feel that 2FA is necessary? How much of a burden on the user is 2FA, and if it's implemented as a feature - should this always be optional?

1
  • What do employees do on that screen ? If it's just to get a quick glance at their stats/data/whatever, the additional waste of time caused by 2FA would deter them from using it altogether. Maybe try to do a compromise, if the screen allows write actions on the data, ask for 2FA only when the user tries to modify something.
    – user42730
    Jan 13, 2015 at 13:38

1 Answer 1

3

2FA is realistically necessary everywhere, but as your front-end developers have said it does not always benefit the end user in terms of user experience. The tricky thing about 2FA is that a user is better protected with it, however it requires extra effort from your user to acquire this protection, some users feel this is a massive burden. This is a lot of the reason why big sites will let you have the option to enable/disable 2FA, people like instant gratification and logging into a site can be tedious hense why so many people autofill their usernames and passwords.

Maybe instead of forcing 2FA, you implement it in a similar way to Steam? I can log in normally everytime I visit, as soon as I visit on a different machine, it requires me to verify with my phone or my email. This is really clever, I am not forced to use it, yet I feel protected when I change my behaviour.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.