0

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be "left out" my account.

Google (for example) provides a lot of ways to avoid that (SMS, calls, several phone numbers, offline, printed codes, etc). However I can't stop thinking in the "what if ... and I can't login when I need it".

So I thought of an hybrid authentication process that I believe it could work and I want to know if you see in flaws in it or you think it would be safe. It would be using 2 step authentication but being able to set up one (or several) just-in-case passwords. If, for some reason you can't access the second-step-device you can use one of those passwords (without the second authentication factor). Then, that password would be disabled until you access the account using the 2 step authentication and you can decide to either delete it or re-enable it (according the environment where you used it).

What do you think?

Improve this question
5
  • 1
    What benefit does this give over the printed codes?
    – Ben
    Commented Jan 8, 2016 at 15:48
  • Google, and many others, give you scratch codes - which is what @Ben mentioned as well. These are one-time use, and they fall into the category "something you have". However, you can come up with a scenario "what if I don't have those scratch codes and the device at the same time".
    – Mjh
    Commented Jan 8, 2016 at 15:53
  • But the suggested replacement is a set of one-time use passwords, which I presume you're not going to be able to remember, so you'll write them down or print them out or put them in a password manager, making them equivalent to the scratch codes, except they are user-chosen, thus potentially very weak.
    – Ben
    Commented Jan 8, 2016 at 16:15
  • As @Mjh said, I was thinking exactly in not having the scratch codes with me. Is true that the user-chosen password could be week, but they could also be remembered. Also, probably any user so advanced to use this kind of stuff, wouldn't chose very week password.
    – Diego
    Commented Jan 8, 2016 at 17:30
  • You could setup the email of a friend, or another phone number, like Google. If you lose the device, the site can send a code to the email or phone, but only the code without telling anything about. You them ask your friend to send you the code.
    – ThoriumBR
    Commented Jan 8, 2016 at 17:59

1 Answer 1

Reset to default
2

I believe that would defeat the purpose of two-factor authentication. The point of two-factor is to have two forms of verification: 1) one that you are responsible to generate yourself and know and 2) one that you don't generate and know.

Creating codes generated by the service does the same thing as far as having a second code you can physically keep and know, but at least you didn't generate it yourself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .