Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

These days, there's pretty much three forms of authentication in general use on the web:

  • Single-factor authentication, e.g.: PIN or password.
  • Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
  • "Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.

Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".

So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?

share|improve this question

8 Answers 8

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.

share|improve this answer
    
This is a better answer than my answer. You explained it very well. I think you answer should be the best answer so far. –  Abu Ubaidah May 13 at 16:19
    
I don't agree that an OTP value is "something you know". It is not committed to your memory and most people would not be able to mentally calculate their OTP value given the seed value. They rely on their device or software to provide that temporary value. If an attacker copies the OTP seed then they are essentially copying 'what you have' even if it isn't physical. –  PwdRsch May 13 at 20:32

I wouldn't really classify the "two-step" as a distinction. It's a mechanism of a factor that may or may not still be something you know. For example, if the code is sent to a cellphone, then it's really something you know (password) and something you have (cellphone). If it's sent to an e-mail, it's really still single factor since both the e-mail and account are (most likely) password derived.

It's certainly still a mechanism of validation in the e-mail sense, but it doesn't add any more than asking for a second password would do in terms of authentication.

share|improve this answer

You can simply say that every Two-Factor authentication is a Two-Step authentication, but not the other way around.

When, I enter my password and scan my fingerprint, I am doing a Two-Step authentication and using a Two-Factor (something you know, something you are)

However, when I entered my regular account password and a one-time-password, I am doing Two-Step but only use One-Factor (something I know)

share|improve this answer
8  
A one time password/passcode (OTP) is generally not something you know. A one OTP is generated by something you have - either generated by a token or refers to a physical sheet/card with a listing of one time codes. Entering the one time code proves that you have the devices or the listing sheet. –  Eric G Mar 25 '14 at 16:47
    
There are numerous examples of true 2 factor authentication that is NOT 2 steps. E.g. biometrics of how you type in your password (aka behavioral biometrics). The rest of the answer is similarly wrong. –  AviD May 13 at 15:58
    
@AviD The key point here is the "not the other way around" bit - that not all two-step is two-factor. That all two-factor implementations don't require two steps is really irrelevant to the question. (Though yes, this answer does have it wrong.) And the OTP is really a bad analogy too - as Eric points out, there are some "OTP" implementations that do qualify as two-factor and some that don't. –  Iszi May 13 at 16:00
    
I agree about the relevance to the question, but that is the core of the answer. –  AviD May 13 at 16:02
    
@EricG In the case of the device, good hardware OTP generators can qualify as "something you have". But providing an OTP from a list kept on paper doesn't prove that you have the list with you - it only proves that you've seen the list at some point in time and are good at memorizing (or copying, or taking a picture of, etc...) that kind of stuff. –  Iszi May 13 at 16:06

Here's a flow diagram explaining the differences.

Source: https://ramblingrant.co.uk/the-difference-between-two-factor-and-two-step-authentication

difference between two-factor authentication and two-step verification

share|improve this answer

EDIT (15/5/2015): Paul Moore's answer seems sounder technically than mine (upvoted it)


I am missing any reputable source in current answers, so I will refer to Schneier and to Google's own help pages to argue that "two-step" is just a layperson-friendly name for two-factor authentication:

Schneier:

Recently, I've seen examples of two-factor authentication using two different communications paths: call it "two-channel authentication." One bank sends a challenge to the user's cell phone via SMS and expects a reply via SMS. If you assume that all the bank's customers have cell phones, then this results in a two-factor authentication process without extra hardware. And even better, the second authentication piece goes over a different communications channel than the first; eavesdropping is much more difficult.

Google support (and others that I can't post because lack of reputation): Just notice how they interchangeably use them, rather falling back to "factor" when the thing gets technical.

share|improve this answer
    
Just because a self-interested organization says "our two-step is two-factor" doesn't make it right. As for Schneier, note how his example substantially differs from most SMS authentication schemes. Most SMS-as-a-factor implementations simply send a code in a message to the user and have the user enter that code into the web form after their password using the same device (usually, their computer) they started filling the form on. Schneier's suggestion much more closely approaches true two-factor by actually requiring the response to be from the authorized cell phone. –  Iszi May 13 at 16:22
    
The self-interested organizations are there as backup to what the Schneier quote says in the bulk of my answer. And as for your interpretation of the quote, I fail to see how such interpretation changes things for the better: it's easier to have an unsophisticated/hacked user answer an SMS on the receiving cell phone than to have him type the received code into a different device. –  hmijail May 15 at 0:01

From an information-theory point of view, there isn't any difference between them. This is why entanglement doesn't allow for FTL transmission of data, it's as if you wrote down the information on a piece of paper and walked a mile, and then opened it. The information wasn't transmitted across time, it was there all along. Perceptually it's different for us, but it's all chained to preexisting "information you know."

That being said, there ARE security implications between the two. Cracking a deterministic token generally requires social engineering or rubber-hose based attacks. If the man is out to get you and they know you depend on 2-step authentication, they can monitor the out-of-band signal and correlate your activities. Let's say, for example, you operate .onion site on the TOR network that requires a text message for the out-of-band second step. If you are 1/100 people on a list of possible suspects, they could check the time-stamps on all of your text messages and correlate changes on the site.

share|improve this answer

The difference is addition versus multiplication.

Two-step is an additive process: you authenticate once with one independent credential (a password), and then again with another independent credential (a OTP, either delivered via SMS, phone, or in some generator app). You have authenticated yourself twice.

Two-factor is multiplicative: you're combining one independent credential (a PIN or secret key or biomarker) with another (a certificate, or a cryptographic token code) to derive a stronger single credential than each independent credential.

Assigning completely arbitrary and convenient numbers to credential types (1=none, 2=password [any kind: self-defined, OTP, etc], 3=crypto credential [cert, token code]), I can demonstrate that a password is stronger than no password (2>1); that two-step authentication is stronger than a single password ((2+2=4)>2) or a crypto credential ((2+2=4)>3) independently, but always weaker than any multi-factor scheme ((2+2=4)<(2*3=6)).

share|improve this answer

Your definitions are a little off. Two Step Verification (I'm assuming you are thinking of Google) can use tokens too, and Two Factor Authentication could use codes, or biometrics, or really anything that gives you two or more of the categories: What you know, what you have, or what you are.

What distinguishes Google's two step verification from proper two factor authentication is that you are not always required to use the second factor to authenticate. It only asks you to use it to verify your identity when there is doubt, or when the cookie it set in your browser expires.

As to the status of a phone or e-mail account as a factor, I'd classify it as something you have. It is as much something you have as a software token is. Sure you know the password to the e-mail account, but you could also know the seed data to re-create a software token.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.