0

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on my team think that it won't be very user friendly (many of our users are very non-technical) and are advocating to use SMS as another form to authenticate. I've heard that SMS is vulnerable to SIM swapping attacks and isn't recommended, but those who advocate say that SMS is better than nothing. My main question is if we should allow for TOTP, SMS, or both? I’m afraid that if we release MFA with 2 options: TOTP and SMS, then most users will choose SMS over TOTP, and we’ll be in a bad spot long term.

2
  • Does this question help? Commented Apr 22 at 18:03
  • 2
    This isn't a dichotomy (an "either-or" situation). SMS is both not recommended and better than no MFA. However, we can't weigh in on the "user-friendly" aspect of your question, only the security of your question, since we don't know your userbase or the effect of forcing TOTP and not SMS. In short, offer something that your users can use. We can't provide an answer on what that will be for your users.
    – schroeder
    Commented Apr 22 at 21:51

0

Browse other questions tagged .