Is an emailed PIN for 2FA worthwhile?

Question

To log in to our web app, our security team is insisting on 2FA as it is hosted on our internal network.

The proposed solution is to have a standard username (email address) and password login, which will then trigger a four digit PIN emailed to the user which they will have to enter to log in.

To my mind that is two sides of the same coin (something the users knows) - using the email address, rather than sending the PIN to a phone number or a physical token.

Is this strictly 2FA? Is it just a negative experience to the user interrupting the login process flow in return for little gain in terms of security?

Answer 1

It is usually called two step authentication, and in security circles, it's not considered 2FA. The reason is because the three factors of authentication are "something the user knows", "something the user has", and "something the user is". Email cannot be considered "something the user has" because to login to the email address, typically all the user needs to know is another set of user name and password (unless your company already had 2FA on email).

Many systems, esp. financial institutions and now Google, FB, Twitter, Microsoft Account etc., will use a phone number because the user has to prove they are in possession of the phone.

2FA is often going to be worse login experience than single-factor, but it comes down to what's at stake. If its high business impact information (such as sensitive data, ability to make financial transactions, customer PII), typically 2FA will be favored over user experience.

Having said that, security is as good as its weakest link. So even after you applied 2FA (or two step verification) for users, if the underlying data was accessible in some other way without that additional security, then it's really an annoyance for the users (and yes, I have seen examples of people trying to do that!)

Answer 2

What you are describing is 2 factor authentication, whether it's the most secure of 2 factor authentication is a question for a security expert though.

Wikipedia does offer a great example of what 2FA is and i believe the step you mentioned would be classed as two 2FA.

an automated teller machine (ATM) typically requires two-factor verification. To prove that users are who they claim to be, the system requires two items: an ATM smartcard (application of the possession factor) and the personal identification number (PIN) (application of the knowledge factor). In the case of a lost ATM card, the user's accounts are still safe; anyone who finds the card cannot withdraw money as they do not know the PIN. The same is true if the attacker has only knowledge of the PIN and does not have the card. From Wikipedia

In fact what you're proposing is very similar to how Steam authenticate users on new machines.

1. You login using your username and password
2. A verification email is sent to an already verified email address to confirm you want to allow access to your account from that machine.

Without access to both the knowledge factor (your username and password) and the possession factor (access to the email address) you cannot login on a new machine.

2FA isn't for everyone though so by default i think this should be turned off and you should encourage the user to activate the feature themselves.

Some users may not want the extra friction which comes with 2FA and some users may simply not value the security of their account higher than ease of login.

Edit: To answer your question... It's not a bad experience IF they're not forced into 2FA and it depends entirely on their value for security over ease of login.

Answer 3

Stick to your instincts Jake... this most definitely isn't 2FA.

What you've described is actually two-step verification, as the OTP via email (or SMS for that matter) isn't considered "something you have" and isn't therefore a second factor.

Here's a flow diagram to help you.

Source: https://ramblingrant.co.uk/the-difference-between-two-factor-and-two-step-authentication