So we are planning on adding a feature to our app that is similar to what Google does, but a little stricter:
- You have a list of sessions that are tied to a user agent and IP address(?) (google shows a location)
- 2FA is only needed when you try to login from a device that hasn’t been approved for the last 30 days.
- If a login attempt is made from a new user-agent/IP pairing, we would like to send a link with a token to their email address to approve the login.
- When they click the link, if 2FA is active, we will ask for 2FA to approve the login.
A few things we are wondering about:
- By making the user take action to approve logins, rather than Google where it just tells you of the login... we hope to prevent a higher number of unauthorized logins. (Currently we send a mail every time the user logs in and we tell them the user-agent and region.)
- By requiring 2FA to utilize the link, we hope to further protect unauthorized login (while you can password reset with email access, we require 2FA auth before you can get to the page for entering the new password after clicking the reset link.)
- Our biggest concern is that we aren’t going to accidentally make some mistake and some user will have to jump through this hoop a billion times in the same session because their mobile carrier is switching their IP constantly... etc etc
So I am getting an idea that IP based restriction is probably not too good... so maybe look up the region via IP and just whitelist the region? But then a hacker could just easily spoof user-agent and use a proxy.
Note: I understand this is not our stop-all for security, but we would like to add this layer to help lower the instances of unauthorized access.
My question: What overall model for session/login restriction will strike a good balance between “preventing newb hackers / jerks from logging in as you when they guessed your password / phished it” and “not annoying the user all the time with mail auth links”?