Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

These days, there's pretty much three forms of authentication in general use on the web:

  • Single-factor authentication, e.g.: PIN or password.
  • Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
  • "Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.

Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".

So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?

share|improve this question

8 Answers 8

up vote 6 down vote accepted

You can simply say that every Two-Factor authentication is a Two-Step authentication, but not the other way around.

When, I enter my password and scan my fingerprint, I am doing a Two-Step authentication and using a Two-Factor (something you know, something you are)

However, when I entered my regular account password and a one-time-password, I am doing Two-Step but only use One-Factor (something I know)

share|improve this answer
A one time password/passcode (OTP) is generally not something you know. A one OTP is generated by something you have - either generated by a token or refers to a physical sheet/card with a listing of one time codes. Entering the one time code proves that you have the devices or the listing sheet. –  Eric G Mar 25 '14 at 16:47

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical token, for example.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.

share|improve this answer

I wouldn't really classify the "two-step" as a distinction. It's a mechanism of a factor that may or may not still be something you know. For example, if the code is sent to a cellphone, then it's really something you know (password) and something you have (cellphone). If it's sent to an e-mail, it's really still single factor since both the e-mail and account are (most likely) password derived.

It's certainly still a mechanism of validation in the e-mail sense, but it doesn't add any more than asking for a second password would do in terms of authentication.

share|improve this answer

I am missing any reputable source in current answers, so I will refer to Schneier and to Google's own help pages to argue that "two-step" is just a layperson-friendly name for two-factor authentication:


Recently, I've seen examples of two-factor authentication using two different communications paths: call it "two-channel authentication." One bank sends a challenge to the user's cell phone via SMS and expects a reply via SMS. If you assume that all the bank's customers have cell phones, then this results in a two-factor authentication process without extra hardware. And even better, the second authentication piece goes over a different communications channel than the first; eavesdropping is much more difficult.

Google support (and others that I can't post because lack of reputation): Just notice how they interchangeably use them, rather falling back to "factor" when the thing gets technical.

share|improve this answer

From an information-theory point of view, there isn't any difference between them. This is why entanglement doesn't allow for FTL transmission of data, it's as if you wrote down the information on a piece of paper and walked a mile, and then opened it. The information wasn't transmitted across time, it was there all along. Perceptually it's different for us, but it's all chained to preexisting "information you know."

That being said, there ARE security implications between the two. Cracking a deterministic token generally requires social engineering or rubber-hose based attacks. If the man is out to get you and they know you depend on 2-step authentication, they can monitor the out-of-band signal and correlate your activities. Let's say, for example, you operate .onion site on the TOR network that requires a text message for the out-of-band second step. If you are 1/100 people on a list of possible suspects, they could check the time-stamps on all of your text messages and correlate changes on the site.

share|improve this answer

The difference is addition versus multiplication.

Two-step is an additive process: you authenticate once with one independent credential (a password), and then again with another independent credential (a OTP, either delivered via SMS, phone, or in some generator app). You have authenticated yourself twice.

Two-factor is multiplicative: you're combining one independent credential (a PIN or secret key or biomarker) with another (a certificate, or a cryptographic token code) to derive a stronger single credential than each independent credential.

Assigning completely arbitrary and convenient numbers to credential types (1=none, 2=password [any kind: self-defined, OTP, etc], 3=crypto credential [cert, token code]), I can demonstrate that a password is stronger than no password (2>1); that two-step authentication is stronger than a single password ((2+2=4)>2) or a crypto credential ((2+2=4)>3) independently, but always weaker than any multi-factor scheme ((2+2=4)<(2*3=6)).

share|improve this answer

Your definitions are a little off. Two Step Verification (I'm assuming you are thinking of Google) can use tokens too, and Two Factor Authentication could use codes, or biometrics, or really anything that gives you two or more of the categories: What you know, what you have, or what you are.

What distinguishes Google's two step verification from proper two factor authentication is that you are not always required to use the second factor to authenticate. It only asks you to use it to verify your identity when there is doubt, or when the cookie it set in your browser expires.

As to the status of a phone or e-mail account as a factor, I'd classify it as something you have. It is as much something you have as a software token is. Sure you know the password to the e-mail account, but you could also know the seed data to re-create a software token.

share|improve this answer

Here's a flow diagram explaining the differences.

Source: https://ramblingrant.co.uk/the-difference-between-two-factor-and-two-step-authentication

difference between two-factor authentication and two-step verification

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.