We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?

Google Auth uses SMS as backup option but SMS does not have a backup and when the user cannot receive SMS for whatever reason he/she cannot login. I know we can backup SMS with voice calls but these situations might still arise.

  • A lot of people use their mobile phone for 2FA. Most of those people also receive their email on that phone. This means that their email will be compromised as well. A cooldown time of about a week to a month seems necessary to me.
    – user36088
    Dec 20, 2013 at 10:20

1 Answer 1


Should we allow the administrators of the site to turn off TFA for users?

This is a very interesting question. I suspect the answer very much depends on the individual site's risk assessment. Let's look at some pros and cons of allowing the administrator to turn off 2FA for an individual user.


  • Convenient for the user if he loses access to his authentication token.


  • Subject to phishing attacks. An attacker could call/email the customer service representative and pretend to be the user asking them to turn off the 2FA. You might think your customer service representatives are smarter than that but you will be surprised. Mat Honan is living proof that this is a very real threat.

However, there might be a legitimate use case in which the user has lost access to his authentication token and needs it to be reset somehow. I would make the user go through the same process as he would need to when resetting his password. This could involve emailing him a link to trigger to process or something similar. The idea here is to make it as difficult for an attacker as possible to do this as he will need to compromise the user's email account as well.

  • We are operating a site where we collect some personal informaition that we can verify. I'll create a process that requires the personal details of the user to be verified before an admin can manually disable TFA. But now I'll have to make sure that the admin has actually verified the personal details before allowing her to do this. Which is a pain.
    – Emre K.
    Dec 20, 2013 at 11:34
  • @AntonAnsgar That can be done automatically through something like email a link to the user.
    – user10211
    Dec 20, 2013 at 11:42
  • 1
    That means all the attacker has to do is to take control of users email address right? Which kind of beats the purpose
    – Emre K.
    Dec 20, 2013 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .