Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using a password and a TOTP, for example like Gmail, Facebook, ...etc

Is it still secure to use the same password on those services as long the second factor is different?

share|improve this question

If that other factor is enough to protect your security for you, then sure. The point of multiple passwords is that if one is compromised, they aren't all compromised. If you reuse the password and one account is broken, that factor is broken everywhere it is used. If you don't mind a one time code being all that stands between an attacker and your g-mail account, then there is no reason not to use the same password. It is certainly far less secure, but it's also far more useable. It's a personal choice based on what you think the trade off is between security and usability.

share|improve this answer

Apart from the use of two-factor authentication, it would be preferable to use different passwords for each service. Let's say that depends on your needs, even if it may be assumed that the two-factor authentication dramatically increases security.

share|improve this answer

You will make things easier for someone looking to compromise your password irrespective of that second factor. You're under the impression that any second factor will be more secure than the first. Think about that for a moment.

Imagine you put your trust in Acme Dual Factor company. You trust that they will be your "overseer" in the sense that you have one key, and they have the other. Chicken or the egg concept. If one was that secure, you wouldn't need the other.

What I have done to manage complex passwords each different across many systems is, I have made myself a mental framework to remember them. It's based on the "something you are, something you have, and something you know" concept.

Something I have: (A Gmail account) Gm@!l
Something I know: (password I choose) f!d0
Something I am: (from New York so I will use) y@nkees

"It would take a desktop PC about 3 quintillion years"

Let's do this again.

Something I have: my bank login (C!t!b@nk)
Something I know: my phone number ... shifted - @)@%%%(*&^
Something I am: from New York


Not my bank, but Gmail:




These are things I can NEVER forget. My phone number holding shift. Where I am from, and what is it I have. There are many mechanisms to commit to memory in order to remember ultra strong passwords. My Truecrypt password is 26 characters, my sign in, 21. Completely DIFFERENT passwords. I remember them all because I created my framework. I back them up using Keepass for safekeeping.

Now, someone will come along and say: "the vulnerability is in your framework" and I will point out, the odds of compromising ANY of those bits of data via say "social recon" is absurd.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.