We have 2FA for the staff interface, it would be nice to have it for the OPAC too. It should probably be a separate options, so 2FA can be enabled/enforced separately for the staff interface and for the OPAC.
We seconded this suggestion. Our library users are increasingly concerned about cyber security. The only thing I'd want to add though is how would this work with the patron API and SIP2?
Other library catalogues and discovery platforms offer two-factor authentication for library members (e.g. Aspen Discovery https://aspen-discovery.atlassian.net/wiki/spaces/Help/pages/339443716/Logging+In#Two-Factor-Authentication) It could be useful to compare this with how we would want things to work in Koha.