Scribd
Upload
8 views4 pages

Enable MFA for Secure Logins

The document outlines two user stories related to enabling and verifying Multi-Factor Authentication (MFA) for authenticated business users. The first story details the process for enabling MFA in account settings, including method selection and validation steps, while the second story describes the MFA verification process during login. Both stories include acceptance criteria, edge cases, error states, and open questions regarding MFA implementation and user experience.

Uploaded by

sakusingh03
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
8 views4 pages

Enable MFA for Secure Logins

The document outlines two user stories related to enabling and verifying Multi-Factor Authentication (MFA) for authenticated business users. The first story details the process for enabling MFA in account settings, including method selection and validation steps, while the second story describes the MFA verification process during login. Both stories include acceptance criteria, edge cases, error states, and open questions regarding MFA implementation and user experience.

Uploaded by

sakusingh03
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

User Story 1: Enabling MFA During Account Settings

User Role:​

Authenticated Business User (Admin or Staff)

Objective / Description:​

As a logged-in user, I want to enable Multi-Factor Authentication (MFA) in my

account settings so that my account has an extra layer of security during login.

Acceptance Criteria:

●​ User can access the “Security Settings” page from their account.
●​ The system should allow the user to choose MFA method (e.g., Authenticator
App, SMS, Email).
●​ After selecting the MFA method:
○​ If Authenticator App is chosen:
■​ Show a QR code for the user to scan.
■​ Prompt the user to enter the 6-digit code from the app.
■​ Validate the code before enabling MFA.
○​ If SMS is chosen:
■​ Prompt user to enter a valid phone number (10-15 digits).
■​ Send OTP via SMS.
■​ Validate OTP before enabling MFA.
●​ A success message is shown after enabling MFA.
●​ MFA status should be updated and stored in the database.
●​ User can disable MFA later by entering a valid password + MFA code.

Edge Cases & Validations:

●​ QR code refreshes every 60 seconds.


●​ Phone number must be validated against country format.
●​ MFA cannot be enabled without a successful code validation.
●​ Users can’t enable multiple MFA methods at once unless supported.

Error States:
●​ “Invalid 6-digit code. Please try again.”
●​ “Phone number format is invalid.”
●​ “Unable to verify MFA setup. Please retry.”

Open Questions:

●​ Do we allow multiple MFA methods per user (e.g., both Authenticator App and
SMS)?
●​ Should we force MFA for admin users?
●​ How often should users re-verify MFA devices?

User Story 2: MFA Verification During Login


User Role:​

Returning Business User (Admin or Staff) with MFA enabled

Objective / Description:​

As a user who has MFA enabled, I want to be prompted to enter a verification code

after entering my correct email and password, to ensure my login is secure.

Acceptance Criteria:

●​ After successful password validation, system checks if MFA is enabled.


●​ If yes, user is prompted for a 6-digit code.
●​ The system validates the code:
○​ If correct, user is logged in.
○​ If incorrect, error is shown and user can retry.
●​ A “Remember this device for 30 days” option is shown.
●​ If “Remember Device” is checked and validated, skip MFA on that device for
30 days.

Edge Cases & Validations:

●​ Limit to 5 incorrect MFA attempts before temporary lockout (e.g., 10 mins).


●​ “Remember Device” uses secure cookies + device fingerprinting.
●​ MFA prompt must timeout after 2 minutes of inactivity.

Error States:

●​ “Invalid MFA code. Please try again.”


●​ “Too many failed attempts. Please try again later.”
●​ “MFA session timed out. Please log in again.”

Open Questions:

●​ How are remembered devices stored and tracked (device ID, IP, fingerprint)?
●​ Is there an option for users to manage or revoke remembered devices?
●​ Should SMS-based MFA be allowed in addition to authenticator apps at login?

You might also like