I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in Windows), when the user is locked out they just need to enter the password (and not the username). I should note that not all accounts will have 2FA enabled. I'm wondering from a security and user experience point of view, which of the following credentials should be required by the user after they're locked out?

  • Username
  • Password
  • Two-factor authentication code
  • 1
    Do you mean "logged out"? – multithr3at3d Jan 22 '17 at 19:41
  • 2
    can you elaborate? You can get lockout but are you logged out? If you are logged out are you locked out? So how lockout are you logging out? Sorry it's like an authentication inception here. Logout or Lockout. Both are distinct scenario but yet similar in some ways. So if you can clear up 'lockout functionality' and the 'lockout link'. – Lester T. Jan 22 '17 at 19:49
  • @LesterT. I think by "lockout", OP means something similar to what Windows has, where you can "lock" your computer; you remain "logged in" but must re-enter your password before regaining access to the system. "account-lockout" is not an appropriate tag for this question, because that is generally used for locking out an account where incorrect credentials have been tried too many times (which I believe is not what the OP is asking about). – Doktor J Apr 7 '17 at 20:36

There is really no "correct" answer that we can give. You need to understand the risks and impacts in order to make a sensible decision. Only you can do that with an understanding of the value of the data and the cost of a breach.

Having said that:

  • Using userid on its own would give no real security and it is common for a system to remember the userid in use via a cookie for the convenience of the user.
  • Requiring password input to reauthenticate would be the minimum requirement I would think
  • Requiring 2FA after a timeout is more secure but likely to get your users leaving in droves! Even many banking apps don't require that. However, again, it depends on the settings you are using. If timeouts are reasonably long then requiring 2FA may be fine. If they happen after 5 minutes of inactivity, that is not likely to be acceptable to users.

So think about the risks and the impact if risks are realised. Think of the value/cost. Not just about the user experience.

Also don't forget that you could get more sophisticated. For example, if your timeout is set to 15 minutes, perhaps you would require re-entry of the password during the next 15 minutes but if the user hasn't responded in 30 min lets say, you might require 2FA.

Also don't forget to add more significant impacts if someone fails to log in after a number of attempts. Generally it is sensible to start by preventing further attempts for a short while with the time increasing on further attempts up to a full lock out requiring administrator input after some number of failed attempts.

  • Regarding 2FA, if your system has a means to "remember" a client and not prompt for 2FA for X days, then the user should not be prompted for 2FA while their session is locked (as you've set an expectation that they should not need their 2FA credentials for that period of X days), though that's more of a UX issue than a security issue and the two are somewhat at odds here. – Doktor J Apr 7 '17 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.