Should we allow the administrators of the site to turn off TFA for users?
This is a very interesting question. I suspect the answer very much depends on the individual site's risk assessment. Let's look at some pros and cons of allowing the administrator to turn off 2FA for an individual user.
- Convenient for the user if he loses access to his authentication token.
- Subject to phishing attacks. An attacker could call/email the customer service representative and pretend to be the user asking them to turn off the 2FA. You might think your customer service representatives are smarter than that but you will be surprised. Mat Honan is living proof that this is a very real threat.
However, there might be a legitimate use case in which the user has lost access to his authentication token and needs it to be reset somehow. I would make the user go through the same process as he would need to when resetting his password. This could involve emailing him a link to trigger to process or something similar. The idea here is to make it as difficult for an attacker as possible to do this as he will need to compromise the user's email account as well.