I am trying to get some clarity on this. I am not looking at personal or risk mgmt perspectives.

Why do we need to protect passwords (or 1st factor) in the context of 2fa (or multi factor authentication) because hacker won't have second factor.

A similar but not exact is to trivialize 1st password to say abc123 and argue hacker won't have 2nd factor ?

What are some technicalities not to let guard down on passwords in the context of 2/mfa?

  • 1
    every factor should be properly secured, always – Daniel Ruf Dec 5 '15 at 8:23
  • Storing passwords as plaintext is never good. What if the database is breached? Passwords should be always stored in a secure hash format. – Daniel Ruf Dec 5 '15 at 11:45
  • Based on your assumptions, no, there is no reason to protect the first factor. But your assumption is invalid, as an attacker cannot, in any way and under arbitrary circumstances, pass the second factor is wrong for any setup in which it is possible to pass the second factor at all (as legitimate user). – dst Dec 5 '15 at 15:49
  • Are you basically asking why we can't just use a something you have factor and forget the something you know factor altogether? – Neil Smithline Dec 5 '15 at 23:50

You've misunderstood the meaning of two factor authentication. If you remove one factor (by trivialising it), then you no longer have two factor authentication, you have one factor authentication (just with a different form of factor - something you have/are, instead of something you know).

You imply that the benefit of 2FA is the strength of the second factor. If that were the case, then you don't need 2FA - simply implement the second factor by itself. No, the benefit of 2FA is the redundancy of having two factors at the same time.

If a hacker breaks one of the factors, you are still protected by the other. E.g. if your internet banking security device gets stolen, you are safe because you still have a password. Alternatively, if someone sees you type your password, you are safe because you still have your device. You've reduced the attack vector to scenarios where the attacker manages to accomplish both tasks.

If you trivialise one of the factors, you might as well not bother with the scheme in the first place.


You can not be sure if there are vulnerabilities in your code.

Passwords should be never stored as plaintext.

People tend to use the same passwords on multiple sites or specific formats like name+birthday or something else.

You have to protect the passwords to prevent abuse if the database is breached.

And no one but only the owner of the account should know the password, ever.

Passwords should be always stored in a hashed format. Please do not use MD5 or SHA-1. Bcrypt is highly recommended.

The telephone numbers for the 2fa should be stored (encrypted, can be decrypted in your sourcecode) in a separate database on a separate server which has additional access protection (no access allowed from remote IPs but only your server IP).

A hacker would need the access to the 2fa device which is not so easy + the password (but he can not decrypt it when stored using bcrypt).

  • Thanks Daniel. Agreed pwds should be hashed w bcrypt or sha2 and not to be stored in plaintext. However I am looking at what's the need for an org to protect passwords when that org is using 2nd factor that a hacker wouldn't have.? Sure passwords can be reused, but that's some other organization's issue. I am looking for justification of dedicating resources to protect passwords when that org is having 2/mfa in place. Unless the second factor is also compromised.. – tech_geek Dec 5 '15 at 12:32
  • You need at least the telephone number as plaintext. Best is in another database on another server which is protected and can just be accessed by your server IP, no remote IPs allowed to access it. You stoe the passwords like you always do, I see no change when using 2fa, the sent secret should be stored as a secure hash or something like Shamir Secret Sharing. A hacker would need access to the telephone (2nd factor device) + the password. But this is likely not possible. – Daniel Ruf Dec 5 '15 at 12:44
  • @DanielRuf Note that 2FA via SMS does not require the attacker to control the device, it is sufficient to be able to receive SMS (common scenarios are for example tricking the user's carrier into sending the attacker a sim card). – dst Dec 5 '15 at 15:51
  • @dst right, but this should be fixed on the side of the carrier. Most carriers here already added some requirements to get a new sim card. We can not control this. That SMS and GSM have security issues is well known. – Daniel Ruf Dec 5 '15 at 16:08
  • @RickyDemer thanks for the hint, I did almost mention Vupen :D – Daniel Ruf Dec 5 '15 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.