A user, supermathie, shares their experience with a 2FA-required site, where after adding authenticators, the error message “You are required to enable two-factor authentication before accessing this site” persists, leaving them wondering about the next steps.
supermathie suggests updating the error message to “You have added at least one authenticator, you may add additional methods or [continue] to the site” with a green background and adding a Continue button for a clear call-to-action.
riking agrees, suggesting that a single Security Key should not be the only option and that a second Security Key or alternate option should be required.
supermathie further suggests that the text should include examples, as users may not be familiar with terms like U2F Yubikey or TOTP. This includes:
Time-Based Tokens (e.g., Google Authenticator)
Security Keys (e.g., Windows Hello, Yubikey, U2F Hardware Tokens)
In a later post, supermathie proposes categorizing security keys into Portable Security Keys (e.g., Yubikey, U2F Hardware Tokens) and Platform Security Keys (e.g., Windows Hello, Apple FaceID).
It’s obvious that I needed to add at least one authenticator to continue, however after adding them the message
You are required to enable two-factor authentication before accessing this site.
does not go away, nor is there a clear next step.
Were I not already familiar I might wonder “Do I need to trigger a save? Where do I go next?”
I suggest:
have the error message change to e.g. “You have added at least one authenticator, you may add additional methods or [continue] to the site.” with a green background
perhaps add a Continue button at the bottom to give the user a clear CTA
This is good feedback. I’d make sure to highly discourage leaving this screen with a single Security Key as the only option - insist that a second SK or alternate option is enabled.
