2FA UX Patterns: Designing Setup Flows for SMS, Authenticator Apps, and Biometrics
Each popular 2FA method in modern digital products, including SMS OTP verification, TOTP authentication apps, and biometrics, has different user flows for setup, verification, and recovery; However, each 2FA flow has a standard template that users are generally familiar with.
2FA user flows should use the highest possible security to protect the user account, but should also be simple, transparent and painless for users to help them adapt to 2FA as a general security requirement. It is the responsibility of a good designer to optimally balance security and usability with better UX flow design in integrating the popular 2FA method:
Configuration and verification flow by method
The 2FA setup and verification processes have standard user flow templates that your digital product design can adopt to improve both security and convenience:
OTP verification via SMS
The 2FA SMS flow involves registering a 2FA phone number and proving the user’s identity via a 4 or 6 digit OTP:
Configuration flow
The setup user flow uses the following standard flow template when registering a 2FA phone number:
- Select SMS OTP verification as the 2FA method.
- Authenticate with the account using login credentials (for security).
- Enter a valid phone number and continue (OTP is now delivered).
- Enter or copy-paste (if the user is on the same device) the OTP. Resending is available for SMS delivery issues or wait times.
- 2FA setup is successful.
Verification flow
The SMS OTP verification flow is almost the same as the setup, but the phone number is automatically retrieved from the product backend:
- Enter the login information.
- Sees the 2FA prompt. Clicks to send OTP, or the product sends it automatically.
- Enter or copy-paste the OTP.
- Authentication is successful.
Common UX Pain Points
- User delays— User may misplace the phone or forget the phone number used for 2FA, so the app may ask the user for confirmation before sending OTP and show the last two digits of the phone number.
- Copy and paste errors — The user should be able to copy and paste the OTP instantly. You must use the standard PIN format (4 or 6 digits) or autofill (or autoverify) if your product is a mobile app.
TOTP Authenticator Apps
The TOTP Authenticator App 2FA flow helps the user configure and use a preferred authenticator app for authentication:
Configuration flow
An authenticator application and the product backend need a shared secret to enable TOTP verification. The user must therefore register your product in a user’s preferred authentication application by scanning a QR code or entering the secret code manually:
- Select TOTP authentication as the 2FA method.
- Authenticate with the account using login credentials (for security).
- Scan the QR code or copy-paste the passcode (if on the same device) to create a new entry using the authenticator app. The authenticator application begins displaying TOTP for the specific product.
- Enter the TOTP.
- 2FA setup is successful.
Verification flow
The user must enter the current TOTP by consulting the authenticator application for verification:
- Enter login credentials
- Sees the 2FA prompt. Open the TOTP authenticator app, search for the product name and enter the current TOTP.
- Authentication is successful
Common UX Pain Points
- Configuration friction— User must download an authenticator app and add the product to enable 2FA. Designers should therefore implement a smooth, descriptive, step-by-step configuration flow to reduce friction.
- TOTP Interval Problems– TOTP updates every 30 seconds, so code expiration while typing is a common problem, but the UX can be improved with support for copy and paste, autofocus and autosubmit
Biometric authentication
Biometric verification flows help users configure and use fingerprint or facial recognition for authentication:
Configuration flow
The configuration flow is instantaneous if the user has already configured the biometric configuration. Otherwise, the user must go through an OS-dependent configuration flow:
- Select biometric verification as the 2FA method.
- Authenticate with the account using login credentials (for security).
- If biometrics are already configured, the user only needs to confirm the biometrics. Otherwise, the user must go through the OS’s native biometric setup with OS-specific UX.
- 2FA setup is successful.
Verification flow
The verification flow verifies the user’s identity with biometric verification:
- Enter the login information.
- The operating system’s native 2FA prompt asks the user to touch the fingerprint sensor or look at the camera for facial verification.
- Authentication is successful.
Common UX Pain Points
- Physical Verification Issues— Fingerprint verification is difficult with dirty or wet hands, and facial recognition may fail when the face is covered and in dark areas. Suggesting another secure 2FA for the current login attempt if biometric verification repeatedly fails is a common solution.
- Security issues— Users may fear using biometrics since biometric data cannot be reset. Sticking to the operating system’s native biometric feeds and educating the user with links to learn more are common solutions for this.
Handling failures and edge cases
Once configured, 2FA authentication may fail, or the user may lose access to it as well. It is therefore crucial to manage these scenarios in a user-friendly, efficient and secure manner:
- OTP delivery issues— SMS OTP delivery may fail or experience delays, so your 2FA flow should include a way to resend the OTP action and use another 2FA method.
- Lost or broken device — A lost or broken 2FA-configured device should prevent the user from accessing the product. Offering a 2FA method like recovery codes or using a 2FA recovery method (e.g. email) are common solutions.
- Network latency — Slow networks can make 2FA interaction problematic, especially with wait times, but this can be resolved with optimized network queries, minimal 2FA UI, and recommending offline OOTP methods.
Do’s and don’ts
| Postman | Do | Don’t do it |
|---|---|---|
| OTP entry design | Autofocus and autosubmit. Hide or use a separate entry per digit. Enable pasting | Make it too small. Use plain text inputs |
| Fallback methods | Provide a clear and direct recovery path | Complicate things with generic or wordy instructions |
| Selection of 2FA methods | Let users choose multiple preferred 2FA methods | Force the user to adapt to just one |
| Ignore 2FA | Support securely skipping 2FA for convenience on trusted devices and more. | Overwhelming users with 2FA or recklessly ignoring 2FA (creates security vulnerabilities) |
| Safety education | Use the concise benefits of 2FA security. Provide links to learn more | Use technical or cybersecurity jargons |
FAQs
How many attempts should I allow for SMS OTP?
3 is recommended
How many forwards should be allowed for SMS OTP?
2 is the safest and also practical
Should QR codes be displayed by default or on demand?
It depends on the device. If the user is using a desktop computer, it is recommended to display the QR. If the user is on mobile, display the passcode instead so the user can copy and paste it into the authenticator app.
The article 2FA UX Patterns: Designing Setup Flows for SMS, Authenticator Apps, and Biometrics appeared first on the LogRocket Blog.
Berita Terkini
Berita Terbaru
Daftar Terbaru
News
Berita Terbaru
Flash News
RuangJP
Pemilu
Berita Terkini
Prediksi Bola
Togel Deposit Pulsa
Technology
Otomotif
Berita Terbaru
Daftar Judi Slot Online Terpercaya
Slot yang lagi gacor
Teknologi
Berita terkini
Berita Pemilu
Berita Teknologi
Hiburan
master Slote
Berita Terkini
Pendidikan
Resep
Jasa Backlink
One Piece Terbaru
