Protecting the user from unauthorized access

Question

So we are planning on adding a feature to our app that is similar to what Google does, but a little stricter:

1. You have a list of sessions that are tied to a user agent and IP address(?) (google shows a location)
2. 2FA is only needed when you try to login from a device that hasn’t been approved for the last 30 days.
3. If a login attempt is made from a new user-agent/IP pairing, we would like to send a link with a token to their email address to approve the login.
4. When they click the link, if 2FA is active, we will ask for 2FA to approve the login.

A few things we are wondering about:

1. By making the user take action to approve logins, rather than Google where it just tells you of the login... we hope to prevent a higher number of unauthorized logins. (Currently we send a mail every time the user logs in and we tell them the user-agent and region.)
2. By requiring 2FA to utilize the link, we hope to further protect unauthorized login (while you can password reset with email access, we require 2FA auth before you can get to the page for entering the new password after clicking the reset link.)
3. Our biggest concern is that we aren’t going to accidentally make some mistake and some user will have to jump through this hoop a billion times in the same session because their mobile carrier is switching their IP constantly... etc etc

So I am getting an idea that IP based restriction is probably not too good... so maybe look up the region via IP and just whitelist the region? But then a hacker could just easily spoof user-agent and use a proxy.

Note: I understand this is not our stop-all for security, but we would like to add this layer to help lower the instances of unauthorized access.

My question: What overall model for session/login restriction will strike a good balance between “preventing newb hackers / jerks from logging in as you when they guessed your password / phished it” and “not annoying the user all the time with mail auth links”?

Answer 1

To be honest, there is no "right answer" and this will probably require some trial and error. I use a VPN all the time and hop IP's - but I know when I do that my bank requires 2FA every single time. That's a choice I'm willing to make, whereas your users may not. Most people with unusual IP's will accept this part of privacy, and those who use the same ISP subnet connecting from the same place (their house or place of business) will expect consistency, so a Malaysian IP will look odd and 2FA will do exactly what it's supposed to do here.

Generally, a mobile user will not have to jump through hoops unless you connect and reconnect to new networks while using your application. If using cellular data, they should be fine and maintain a consistent session.

Depending on what sector and how critical the data is you're protecting, its almost always better to lean on the side of caution. Make sure to put in a login note to tell users why and how you're protecting their data and they will either understand or whine and deal with it anyway. Breaches are in the news daily due to people trading convenience for security, and I would never want to explain to my CEO why a squeaky wheel client changed my mind about blocking an IP or using 2FA resulting in a fully compromised server and a .csv on pastebin with 1 million of our customers creds.