What are the common security risks in MFA design?

When designing Multi-Factor Authentication (MFA) flows and deciding which MFA methods to implement, you must consider the following four security risks to ensure the user’s safety, security, and privacy. Specifically, you must ensure that user data isn’t lost, stolen, phished, intercepted, or inaccessible:

Good UX and inclusive design should also be factored in, but shouldn’t take precedence over the user’s safety and security.

How do you balance security and user convenience in MFA?

Putting aside the required level of security as determined by any laws and regulations, the optimal balance between security and user convenience should depend on your product differentiation/competitive advantage strategy, since you may only be able to outshine rival products in terms of security or user convenience, but not both.

Over 200k developers and product managers use LogRocket to create better digital experiences

Learn more →

To get the right balance, I recommend the following strategy:

1. Implement the MFA methods that are acceptable to you cost-wise (SMS, for example, has recurring costs) and consider the others eliminated at least for the purpose of keeping this study simple
2. After the user authenticates, present them with a CES (Customer Effort Score) survey
3. Ask them to rate how much effort they felt was required to authenticate using their method of MFA (if they complete the survey more than once, keep all of the data but only consider the most recent answer for this exercise)
4. After a while, each MFA method will have a Customer Effort Score
5. To measure security, simply benchmark the number of incidents (e.g., unauthorized account access) for each MFA method

Users might not understand the security implications of different MFA methods, so use these data points to your best judgment to determine which methods are right for your users.

Alternatively, if you’re able to calculate the costs of successful security breaches, revenue retained as a result of thwarting security breaches, and customers leaving due to a lack of security or user convenience, that’ll be a more direct way of getting the answer that you want, but you’ll need to plan very carefully, ensure that the numbers represent reality, and verify all facts (e.g., “Customer #123 with a Customer Lifetime Value of $456 churned due to a security breach relating to MFA method A”). This approach is more definitive, but significantly harder.

How can adaptive authentication enhance MFA security?

Adaptive authentication, sometimes called risk-based authentication, adapts the authentication flow for each user based on the risk of a security breach. For example, users might be presented with additional security measures if they try to authenticate:

• From a different location
• Using an unknown device
• At an unusual time or day
• Or while connected to a suspicious network or IP address

However, if the user is determined to be low-risk, they’ll be presented with a more convenient method of authentication (just a password, perhaps). Ultimately, this increases MFA security when additional MFA security is needed, but focuses more on user convenience otherwise.

LogRocket helps you understand how users experience your product without needing to watch hundreds of session replays or talk to dozens of customers.

LogRocket's Galileo AI watches sessions and understands user feedback for you, automating the most time-intensive parts of your job and giving you more time to focus on great design.

See how design choices, interactions, and issues affect your users — get a demo of LogRocket today.