60

These days, there's pretty much three forms of authentication in general use on the web:

  • Single-factor authentication, e.g.: PIN or password.
  • Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
  • "Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.

Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".

So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?

Improve this question

9 Answers 9

Reset to default
81

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.

Improve this answer
10
  • 28
    I don't agree that an OTP value is "something you know". It is not committed to your memory and most people would not be able to mentally calculate their OTP value given the seed value. They rely on their device or software to provide that temporary value. If an attacker copies the OTP seed then they are essentially copying 'what you have' even if it isn't physical.
    – PwdRsch
    May 13, 2015 at 20:32
  • 16
    ALL "something you have" are backed by secrets that could be copied (except hard-to-forge hardware you need to show to a human, like a passport). Smart cards, Yubikeys, TPM chips; these can all be copied in the same way that Google Authenticator secrets can be copied. Even SIM cards can be cloned to get your SMSs. As you say, the point is "multiple types of attacks", and owning your phone and guessing your password IS two different kinds of attacks. You're in my opinion making a false distinction.
    – Thomas
    Mar 18, 2016 at 13:14
  • 2
    @tylerl you may argue that they are not as secure, but they are second factors.
    – Thomas
    May 27, 2016 at 14:22
  • 2
    @Thomas If you already have one "something you know" factor (your password), adding a second "something you know" (a one-time-password, a private key, etc.) isn't a second factor, it's a second step. If your hardware prevents data extraction, then a key embedded in that hardware is no longer knowledge, it becomes a possession (because it can't be copied), meaning it's now a different factor. But if your protection is insecure and copying is possible, then it becomes knowledge again. Keeping the distinction clear means that security policy can make stronger guarantees.
    – tylerl
    May 27, 2016 at 17:49
  • 3
    @tylerl OTP devices, maybe. TPM chips and Yubikeys could have software flaws just as much as your phone can. It's just software running on hardware there too. There's a difference in degree of attack surface, but not kind. OTP on paper or offline OTP generator are not subject to these attacks, of course.
    – Thomas
    Jun 29, 2016 at 7:55
15

Here's a flow diagram explaining the differences.

difference between two-factor authentication and two-step verification

Source: https://ramblingrant.co.uk/the-difference-between-two-factor-and-two-step-authentication

Improve this answer
1
  • 4
    Thanks for your diagram. Looks like the source has been changed to paul.reviews/…?
    – BNK
    Mar 25, 2017 at 4:45
9

I wouldn't really classify the "two-step" as a distinction. It's a mechanism of a factor that may or may not still be something you know. For example, if the code is sent to a cellphone, then it's really something you know (password) and something you have (cellphone). If it's sent to an e-mail, it's really still single factor since both the e-mail and account are (most likely) password derived.

It's certainly still a mechanism of validation in the e-mail sense, but it doesn't add any more than asking for a second password would do in terms of authentication.

Improve this answer
8

You can simply say that every Two-Factor authentication is a Two-Step authentication, but not the other way around.

When, I enter my password and scan my fingerprint, I am doing a Two-Step authentication and using a Two-Factor (something you know, something you are)

However, when I entered my regular account password and a one-time-password, I am doing Two-Step but only use One-Factor (something I know)

Improve this answer
6
  • 13
    A one time password/passcode (OTP) is generally not something you know. A one OTP is generated by something you have - either generated by a token or refers to a physical sheet/card with a listing of one time codes. Entering the one time code proves that you have the devices or the listing sheet.
    – Eric G
    Mar 25, 2014 at 16:47
  • There are numerous examples of true 2 factor authentication that is NOT 2 steps. E.g. biometrics of how you type in your password (aka behavioral biometrics). The rest of the answer is similarly wrong.
    – AviD ♦
    May 13, 2015 at 15:58
  • @AviD The key point here is the "not the other way around" bit - that not all two-step is two-factor. That all two-factor implementations don't require two steps is really irrelevant to the question. (Though yes, this answer does have it wrong.) And the OTP is really a bad analogy too - as Eric points out, there are some "OTP" implementations that do qualify as two-factor and some that don't.
    – Iszi
    May 13, 2015 at 16:00
  • I agree about the relevance to the question, but that is the core of the answer.
    – AviD ♦
    May 13, 2015 at 16:02
  • @EricG In the case of the device, good hardware OTP generators can qualify as "something you have". But providing an OTP from a list kept on paper doesn't prove that you have the list with you - it only proves that you've seen the list at some point in time and are good at memorizing (or copying, or taking a picture of, etc...) that kind of stuff.
    – Iszi
    May 13, 2015 at 16:06
3

The difference is addition versus multiplication.

Two-step is an additive process: you authenticate once with one independent credential (a password), and then again with another independent credential (a OTP, either delivered via SMS, phone, or in some generator app). You have authenticated yourself twice.

Two-factor is multiplicative: you're combining one independent credential (a PIN or secret key or biomarker) with another (a certificate, or a cryptographic token code) to derive a stronger single credential than each independent credential.

Assigning completely arbitrary and convenient numbers to credential types (1=none, 2=password [any kind: self-defined, OTP, etc], 3=crypto credential [cert, token code]), I can demonstrate that a password is stronger than no password (2>1); that two-step authentication is stronger than a single password ((2+2=4)>2) or a crypto credential ((2+2=4)>3) independently, but always weaker than any multi-factor scheme ((2+2=4)<(2*3=6)).

Improve this answer
3

EDIT (15/5/2015): Paul Moore's answer seems sounder technically than mine (upvoted it)

I am missing any reputable source in current answers, so I will refer to Schneier and to Google's own help pages to argue that "two-step" is just a layperson-friendly name for two-factor authentication:

Schneier:

Recently, I've seen examples of two-factor authentication using two different communications paths: call it "two-channel authentication." One bank sends a challenge to the user's cell phone via SMS and expects a reply via SMS. If you assume that all the bank's customers have cell phones, then this results in a two-factor authentication process without extra hardware. And even better, the second authentication piece goes over a different communications channel than the first; eavesdropping is much more difficult.

Google support (and others that I can't post because lack of reputation): Just notice how they interchangeably use them, rather falling back to "factor" when the thing gets technical.

Improve this answer
2
  • Just because a self-interested organization says "our two-step is two-factor" doesn't make it right. As for Schneier, note how his example substantially differs from most SMS authentication schemes. Most SMS-as-a-factor implementations simply send a code in a message to the user and have the user enter that code into the web form after their password using the same device (usually, their computer) they started filling the form on. Schneier's suggestion much more closely approaches true two-factor by actually requiring the response to be from the authorized cell phone.
    – Iszi
    May 13, 2015 at 16:22
  • The self-interested organizations are there as backup to what the Schneier quote says in the bulk of my answer. And as for your interpretation of the quote, I fail to see how such interpretation changes things for the better: it's easier to have an unsophisticated/hacked user answer an SMS on the receiving cell phone than to have him type the received code into a different device.
    – hmijail
    May 15, 2015 at 0:01
1

From an information-theory point of view, there isn't any difference between them. This is why entanglement doesn't allow for FTL transmission of data, it's as if you wrote down the information on a piece of paper and walked a mile, and then opened it. The information wasn't transmitted across time, it was there all along. Perceptually it's different for us, but it's all chained to preexisting "information you know."

That being said, there ARE security implications between the two. Cracking a deterministic token generally requires social engineering or rubber-hose based attacks. If the man is out to get you and they know you depend on 2-step authentication, they can monitor the out-of-band signal and correlate your activities. Let's say, for example, you operate .onion site on the TOR network that requires a text message for the out-of-band second step. If you are 1/100 people on a list of possible suspects, they could check the time-stamps on all of your text messages and correlate changes on the site.

Improve this answer
0

Your definitions are a little off. Two Step Verification (I'm assuming you are thinking of Google) can use tokens too, and Two Factor Authentication could use codes, or biometrics, or really anything that gives you two or more of the categories: What you know, what you have, or what you are.

What distinguishes Google's two step verification from proper two factor authentication is that you are not always required to use the second factor to authenticate. It only asks you to use it to verify your identity when there is doubt, or when the cookie it set in your browser expires.

As to the status of a phone or e-mail account as a factor, I'd classify it as something you have. It is as much something you have as a software token is. Sure you know the password to the e-mail account, but you could also know the seed data to re-create a software token.

Improve this answer
-3

Two factor usually means that you know something (like a password) and that you own or have something like a token or a mobile phone.

Therefor two step means, that the authentication is done in two steps, one after another. Whether you use two steps just by knowing something like two passwords or you use tokens doesnt matter.

Bruce Schneier even differs between two step and two channel authentication. Two channel authentication is more or less if you have two channels you communicate on. For example if you start an authentication at your desktop computer but you need to end the authentication using your smartphone means that both are used whether in two-step or two-factor authentication but both use different channels.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .