Would adding two factor authentication to an application increase the attack surface of this application?

I think it would, since by adding complexity the likelihood of a vulnerability in my application is increased and so it opens another path for the attacker to exploit the system.

Would this be right?

  • yes, this is correct - more functions = more possibility for vulnerabilities
    – schroeder
    Commented Jan 17, 2016 at 19:52
  • 1
    You have to ask yourself, though, is the increased attack surface worth it? Does the new function mitigate other risks? Known, tested, and mature new functions can be low-risk in comparison to the problem they are fixing.
    – schroeder
    Commented Jan 17, 2016 at 19:54

2 Answers 2


To directly answer the question; it depends on the implementation and/or use-case.

It's not as simple as "more functionality equals greater risk". 2-Factor authentication only ensures that there are at least two channels used as intended and thereby prove that the authentication claim is more than likely correct.

This defeats most of attacks made possible by eavesdropping on a transmission between parties. Assuming the implementation is secure, 2FA tremendously increases security (and to some extent authorization). However, assuming things is always a bad idea, especially in the case of information security.

  • But, the OP is asking about the security of the application, not the user's account.
    – schroeder
    Commented Jan 17, 2016 at 23:13
  • @schroeder hence the emphasis on implementation Commented Jan 17, 2016 at 23:15
  • implementation does not affect attack surface - implementation affects risk
    – schroeder
    Commented Jan 17, 2016 at 23:21

Two factor authentication is a great way to help prevent unauthorized access especially if you use a product that's already been in development and had time to mature. Should you choose to roll your own 2-factor from scratch you expose yourself to many risks thus widening you attack surface. When looking for a provider I would look at something like RSA's SecurID which is a excellent implementation of 2-factor.

  • 2
    Isn't RSA proprietary? I think Google Authenticator is a fine, free option. Commented Jan 17, 2016 at 21:03
  • @NeilSmithline, I believe that it is too but just as an example enterprise product I mentioned RSA.
    – Jingo
    Commented Jan 17, 2016 at 21:06
  • I didn't say you were wrong, just thought there were likely better options for the OP. Commented Jan 17, 2016 at 21:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .