MFA UX Patterns: Security vs Friction Simulator

MFA method

Attack vector

Selected method

Security score

—

Friction score

—

Last login time

—

Last attack success

—

Scoring model

Security and friction are fixed relative estimates per method (illustrative, not measured statistics):

Security — resistance to the three attack vectors combined, 0–100.
Friction — normalized step count + typical wait time, 0–100.

The login timer measures real elapsed time from clicking "Simulate login" to completing the last step — including simulated network/app wait steps that run on their own timer, same as a real login would feel.

The attack simulator rolls one random number against each method's success probability for the chosen vector. SIM-swap has no effect on password-only, since no phone number is bound to that method.

Login simulator — Password onlyClick Simulate login to start

🔑

Ready

Press "Simulate login" below

Elapsed: 0.0s

Security vs friction — all methodsright = more secure · up = less friction

Attack simulatorPhishing vector

No attack run yet.