Simple answer, security. When you set up your account at the HHS office, you would receive your GIN, and you would have a number of options for a 2FA code. The first is hardware authenticator. You would plug your authenticator into the device, and that would authenticate you. The second is with an authenticator app. The third option is sending by email?. And the last option is send by SMS?. Since those that a visually impaired will likely have someone to help them when they log in, this might also be important since the person will only have the OTP (One-Time Passcode). If the person loses their 2FA factor, they can have a new code sent to them, or use an alternative 2FA until they log in, and delete the lost credential.
The first one is a hardware authenticator key such as YubiKey. You would get the USB-C version since your PC and phone only has USB-C ports for data connectivity. When prompted for the 2FA code, they will insert their hardware key, and authenticate. The owner can opt to remember the device for 30 days or not. If they aren’t using their own device, they should not remember the device. They can log in, and do what they need to do. Most hardware authenticators will have a biometric fingerprint reader which will use your fingerprint to authenticate that it is you. This eliminates the worry of someone stealing your hardware key.
The next option is an authenticator app. This is a popular option, and available to anyone with a smartphone. If you are using a KCI device, you would have an authenticator already installed with the OS (K-Wallet). You open K-Wallet, find HHS, and provide the code before it changes (30 second increments). Again, you would elect if the company should remember this device or not. Public access terminals – no! You could also use another authenticator app, but this isn’t required since you have K-Wallet. K-Wallet will synch with all of the devices in your circle.
The next option is email authenticator. The system will send an email to the address it has as the recovery option which can be different from your regular address. HHS will inform that your authenticator code has been sent to your recovery address, and the code will expire in 10 minutes. You have 10 minutes from requesting the passcode to receive it, and enter the OTP. HHS will never disclose your recovery email address on the screen.
The last option is SMS. As with the email address, this is a valid solution if you have no other solution. The passcode can be sent to your SMS number, and again this will never be disclosed on the webpage when it sends the confrimation request. As with the email, you have 10 minutes to receive and enter the passcode.
Even if you select remember this device, you would still be required to enter your credentials when logging in. The only difference is the site will not ask for your authentication code. Since 2FA is required with HHS, this should protect your account, and cause friction even if the bad actor got your GIN, and password. If you received a random request to authenticate your account, log in and change your password. This is a sign that a bad actor might have your credentials, and changing it will make the bad actor’s information out of date.