Email as MFA method?

[tyteen4a03]

Is it possible to use emails as an MFA method?

[vinckr]

Hello @tyteen4a03
See here for an overview of available MFA options: https://www.ory.sh/docs/kratos/mfa/overview

Also Email MFA does probably not help with security - rather use passwordless login via Email TOTP combined with a biometric MFA option.

Email is not true MFA because it does not represent a different factor than the password. It does not represent something I have or something I am, but rather just something I know (the email password). It is also weaker than other factors in that it's only as secure as the email itself (for example, encrypted end-to-end).

[tyteen4a03]

Also Email MFA does probably not help with security - rather use passwordless login via Email TOTP combined with a biometric MFA option.

What makes you think Biometrics are available in all scenarios?

Password + email MFA provides the least friction when it comes to getting users to adopt MFA, even if it isn't "true" MFA. I will take some additional security over no security at all.

[vinckr]

Hey @tyteen4a03

Of course I know next to nothing about your use case, so it might be that there are no modern devices with fingerprint reader or facial recognition available. You can also use TOTP Authenticator Apps - I think everyone with an email account nowadays also has access to a mobile device.

Another alternative that Ory offers is MFA through SMS - now we can argue if this is more or less secure than Email - but it is at least "true" MFA (something you have).

Can you share some details on the special use case you are interested in?

[tyteen4a03]

We want to provide a baseline security profile for our users, which means email MFA is extra security that the user cannot turn off; this rules out anything that requires additional setup for the user (App TOTP, Passkeys, etc).

SMS is not feasible as 1) we do not want to collect phone numbers, and 2) we do not want to pay for SMS.

We only want to trigger email MFA if we detect a user is logging in for the first time on this device, or if a user is changing sensitive information such as their email / password.