Timeline for Is the following considered 2FA?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 19 at 11:01 | comment | added | Ja1024 | An account recovery option doesn’t “reduce the scheme to 1FA”. For example, Amazon (and many other companies) lets you recover from 2FA problems with a government-issued ID which is checked by their support. This doesn’t mean they misunderstand 2FA or lie about using 2FA. The account recovery is a separate procedure outside of the authentication system and has its own rules. For example, you’ll quickly raise suspicion if you try to go through the manual recovery procedure over and over again. | |
| Jun 19 at 1:00 | comment | added | mentallurg | "It will stop being 2FA, if the user can reset the password to System A using the phone number/SIM card" - Exactly. @g.pickardou: This is the reason why your statement "user's authentication method in system A is out of scope in this question, but it is password based" needs more details. If the phone/SIM card is not involved, then it is fine. Otherwise it reduces the scheme to 1FA. | |
| Jun 18 at 7:00 | history | answered | Sreeraj | CC BY-SA 4.0 |