I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.

I think the order of these should be: answer qs---> send code ---> create new password. But our current wireframe has: send code --> answer the qs ---> create new password.


  • First thought is to use a couple of sites that implement these and experience them from a user perspective. Paypal, Amazon, protonmail and anything Goggle would be great places to see how much hassle you might impose on your users. I use 2FA with all these, and it is by choice. But each implements it slightly differently. Also you did not mentionont whether or not you plan to integrate with Authenticator like all these do, or perhaps provide use-once codes like Google does. btw, in the end, you may decide to just let Google do the authenticating for you like Stackexchange does.
    – SDsolar
    Apr 15, 2018 at 4:43
  • We plan to send a one-time PIN to an email or phone, which the user needs to enter on the website to continue in the reset process.
    – Zoey
    Apr 16, 2018 at 15:48
  • Please stop using security questions! They are insecure and require the user to uneccessarily provide (fake) information. How about a predefined list of one time codes that the user can print? You should also add a proper 2FA like U2F or FIDO2. That would be state of the art. Jan 17, 2021 at 20:37

1 Answer 1


Your idea of changing the order is good, because the additional question could be used to avoid sending unnecessary password reset messages just by typing in the username or the email address. The security question is not there because it's secure: their nature tend to be easy to answer after researching the target. That's why the order matters for other reasons.

If you use email addresses as login names, they are bind together in a way that makes it easy to know where the information needed to reset the password goes. That's not generally dangerous to every user, but on a large pool of users there may be someone who's vulnerable. Also, if the email gets compromized first, it may be used for resetting passwords for such sites. In this case, two factors isn't much.

There's all kind of variations, but the factors should always be independent: something you must know and something you need to have access to. Using both email and SMS adds extra level of security, e.g.

  1. Ask security question to launch the process.
  2. Email one-time link to a password reset page.
  3. This page, when accessed, sends a code to the phone.

Nowadays it's common that people have their email on their phone. Having unlimited access to someones phone gives ultimate power over two of these factors: email & SMS. That's why security questios aren't completely pointless even if they don't add a strong layer of security. The phase 1 possibly prevents an unlocked stolen phone from being used for a password reset.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .