New answers tagged

0

Since this is the UX StackExchange, I will answer around the user experience concepts associated with F2A. Need Applications have F2A authentication to protect a user from identify theft and monetary theft and the company from legal action for Personally Identifiable Information(PII) being released. Skipping F2A or OTP for verification is simply not an ...


0

Technically 2FA is part of the login process. The token is required to generate a fully certified authentication (user is who they claim to be). And thus should be requested as part of the login process. You can't separate them since that would mean the user isn't actually logged in. The real question in your case is NOT when to include 2FA but when to ...


4

I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can always ask for 2FA authentication again if the user hasn't provided it in a while and they need to do something which requires extra security. Remember that you ...


2

"As users are able to store personal information including their payment details, this level of verification is needed." Actually, it should only be needed if/when something strange/unusual/out-of-the-ordinary happens regarding the account that has authenticated with a single factor. I.e. 2FA OTP is an annoying step, it is slow and prone to problems (like ...


0

Deciding how complex technology works based on surface-level (interface) analysis is prone to yield outlandish findings. Particularly when it comes to security, as security mechanisms have a constraint whereby they ideally do not divulge their inner workings. So, you feel that a pin code is insecure - but you don't know what is happening under the hood, your ...


2

As per maxathousand's comment: it should be based on a risk assessment. I would add that it should also be based on consideration of you users and their routines. The existence of session windows allows a User to access a system without having to relog, sometimes it may go further in allowing a User to pick-up where they left-off (i.e. avoid having to ...


1

Once. A User should be asked to login to a mobile application on their own personal device one time per device/install so as to access data pertaining to their own account. Anything more is implying that their mobile device is not personal and/or the communication channel is insecure (e.g. MITM attacks). Though there is room for considering (worrying about ...


Top 50 recent answers are included