Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the use of the password and responding to a challenge that can be obtained from a device the user has.
There are a few websites, such as Medium, which has taken this idea of two-factor authentication the other way, by keeping only the second factor. However, Medium implements this by sending a link to the user's registered email address.
- While password managers are a secure way to deal with the problem of having to remember and type in passwords, in case where the password storage of a website may be compromised, it still requires changing passwords; and with some or the other website being compromised each day, it does not make for a good experience on the part of the user.
- A compromise of the email account of the user would imply the compromise of all the accounts linked with it, since most websites allow for password resets by sending an email with a link in it.
I'm having trouble finding a good argument against such a scheme where the first factor is eliminated/replaced for the second factor.
So, why isn't the second factor of authentication more commonly made the only factor, especially in the case of websites that implement just single-factor authentication by the use of passwords? In other words, why not make the challenge-response the only factor instead of having a password?
What are the disadvantages to such a scheme?
There is some debate as to whether an email address can be actually regarded as a second factor; however, I'm asking about the idea in general — the challenge can be, for example, (sent to and) retrieved from a device that the user has.