The best MFA methods are the ones that carefully balance security and user convenience to a degree that feels appropriate for the product, user, and data that it guards. However, passkeys with biometric authentication are generally considered the safest way to authenticate users. Passkeys are safe because they’re:
In any case, when thinking about MFA security, you need to consider the scenarios in which a user, their device, or their account can be:
And in terms of user convenience, you must also consider the following:
The factors that should influence the choice of Multi-Factor Authentication (MFA) methods used are, in order of importance:
Security and accessibility are both non-negotiable from an ethical standpoint and typically required by law. In addition, the potential fines and legal ramifications of not providing sufficient security and accessibility in accordance with any laws and regulations account are the biggest costs associated with implementing MFA.
However, security vulnerabilities are far costlier than accessibility violations, even when your business isn’t directly responsible, so although security, accessibility, and UX should all influence your choice of authentication methods, your choice should be slightly more weighted towards security.
Security compliance and auditing frameworks that mention MFA:
Businesses should comply with as many security frameworks as they can, including industry-specific ones such as CMMC, which is required for US Department of Defense contractors, and HIPAA, which is required for those that handle Protected Health Information (PHI) in the United States.
As alluded to before, the majority of your user base will be entitled to accessibility by law regardless of where the company is legally registered. Most (if not all) regulatory bodies that monitor accessibility state that businesses must comply with the Web Content Accessibility Guidelines (specifically WCAG 2.2, at the time of writing) at Level AA.
However, Level AAA, in addition to rigorous accessibility testing, is highly recommended, especially for something as sensitive as user authentication.
Although UX is extremely important, speed, simplicity, and convenience aren’t more important than safety and security, nor should they take precedence over anybody’s ability to access the product altogether. However, this doesn’t necessarily make UX the lowest priority for two reasons:
LogRocket's Galileo AI watches sessions and understands user feedback for you, automating the most time-intensive parts of your job and giving you more time to focus on great design.
See how design choices, interactions, and issues affect your users — get a demo of LogRocket today.
AI agent simulations promise faster, lower-risk UX testing by replacing real users with AI-simulated personas. Here’s how the method works, where it falls short, and when designers should rely on simulated users versus real user testing.
A/B testing is great for comparing two versions of a design, but multivariate testing helps teams evaluate multiple design element combinations at once. Here’s how both methods work, how they differ, and when UX teams should use each one.
Design engineering has always lived between design and code. But with AI tools turning prompts into interfaces and code into editable canvases, that bridge is becoming a new way of building.
A three-week mobile banking project taught me that the “proper” UX process is not always realistic. Sometimes, the better approach is to work with what you know, identify what you still need to learn, and make the strongest decision possible under real constraints.
Learn more →
