Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the use of the password and responding to a challenge that can be obtained from a device the user has.

There are a few websites, such as Medium, which has taken this idea of two-factor authentication the other way, by keeping only the second factor. However, Medium implements this by sending a link to the user's registered email address.

Medium argues that such a scheme is quite secure as well as being convenient for the users. Their arguments mainly boil down to:

  • While password managers are a secure way to deal with the problem of having to remember and type in passwords, in case where the password storage of a website may be compromised, it still requires changing passwords; and with some or the other website being compromised each day, it does not make for a good experience on the part of the user.
  • A compromise of the email account of the user would imply the compromise of all the accounts linked with it, since most websites allow for password resets by sending an email with a link in it.

I'm having trouble finding a good argument against such a scheme where the first factor is eliminated/replaced for the second factor.

So, why isn't the second factor of authentication more commonly made the only factor, especially in the case of websites that implement just single-factor authentication by the use of passwords? In other words, why not make the challenge-response the only factor instead of having a password?

What are the disadvantages to such a scheme?

There is some debate as to whether an email address can be actually regarded as a second factor; however, I'm asking about the idea in general — the challenge can be, for example, (sent to and) retrieved from a device that the user has.

  • 1
    The subject you're rising is interesting but I'm afraid the way you phrase your question makes it too broad and opinion-based (and it's not even clear what you're asking). Could you please rewrite it in a way that can actually be answered without it being a discussion ? – Stephane Jun 9 '16 at 11:12
  • @Stephane is this any clearer now? I'm asking about the specific disadvantages to such a scheme; as I can't see any particular disadvantage to it. – user2064000 Jun 9 '16 at 11:27
  • 1
    Using only factor two might be more secure than using only factor one. But that does not mean it is more secure than using both factors. – Anders Jun 9 '16 at 11:29
  • 1
    If a second factor is lost or stolen, you don't want whoever finds it to be able to impersonate them. So usually we do "something you have" plus "something you know". But if the second factor has its own PIN, then you're ok to rely on that alone. – paj28 Jun 9 '16 at 11:35
  • @user2064000 Not much, I'm afraid. You're still asking for an opinion, not for facts. Keep in mind, for instance, that there are many applications that requires a single, physical factor for authentication (whatsapp, for instance). – Stephane Jun 9 '16 at 11:35

I think there are two independent questions here that you need to distangle.

Question #1: Should I use just one factor or should I use two?

This is the question that you adress in your title - "Why not make the second factor the only factor?".

Two factor will be safer than one, but it comes with a usability and an implementation cost. If it is worth the cost depends on what your customers are prepared to accept and how valuable the thing you are trying to protect is. For a bank 2FA is almost a must, for an online hobby forum is is probably overkill. No general one size fits all answer is possible.

Question #2: If I use just one factor, which one should you pick?

This is the question the link to Medium (mostly) adresses. It is not the same as the first question.

This basically boils down to "what kind of authentications is best" - obviously a very broad question without a definative answer. But lets look at the scheme you mention.

Using email instead of a password? Can probably be a good idea for a low value target. My hobby forum on shared hosting is way more likely to be breached than the GMail. But if I am a bank this is probably bad, since some customers might have very weak email providers.

Using smartphone instead of a password? If your primary threat is large bot brute force attacks or reused credentials from other breaches this is probably a good idea. If your primary threat is snooping from someone close to you this is probably bad - there are probably a few people in your life that has easy access to your smartphone. So for the hobby forum I would say yes, but for Ashley Madison maybe no. (Or on second thought, maybe it would have been the best for them...)

I think the take home lesson here is that the one factor does not have to be a password, but what it should be depends on the specific circumstances of your situation.


Two factor authentication, is usually based on something you know (a password) and something you have (e.g. RSA token, email account, phone).

If you are the only person that knows your "something you know" then this should be perfectly fine. However brute forcing, rainbow tables, social engineering attacks are all designed to get around that.

The security around "something you have" is based on your ability to maintain ownership. E.g. did you lose your token/phone, has someone hacked your email address.

Overall it's all about risk, it is less likely that you will lose control of both the thing you know and thing you have at the same time, than any one of these individually.

There is also the complication of biometrics. that's simply something that you own, that's really hard to steal without being noticed. However this has the huge disadvantage that if compromised (through say forgery), then there it becomes very hard for you to change it.

On a side note I was made aware of someone who had put their RSA token in front of a webcam and posted all the updates to a website. Given that no-one knew what the token was for, or any of the other necessary credentials, it solved the "I forgot my token" problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.