Why are passwords needed at all if the user signs in using a code from Google authenticator?

  • Simple: There is no user entropy.. That's some degree of randomness from the user that is you... Imagine, a Google employee who gets you Google Authenticator code generation secret can generate a code and log into your account.. – feral_fenrir Sep 1 '16 at 6:09

I guess the first argument could be simply it being "single factor" once again. If you are using single factor authentication the password is the most convenient factor for people to use considering you do not need additional hardware and it is easy to implement.

Also a password is "easier" to store securely compared to a token. The token's security is completely reliant on your device security, it may seem trivial to you that you keep your phone safe (PIN code, encryption, etc...) but that might not be the case for all people.

I know the counter argument here is that in general people use password managers which must be kept safe equally or that, in case they don't, the password might be weak. But bear in mind that not everyone has a smartphone or might have the best security hygiene, in such cases the password is still the easiest to adopt since all you need is your brain to remember it.


If someone finds your phone, they have complete access to your account.

A single point of failure like this is what we're trying to get away from.

  • 2
    And to preempt the "but my phone's password-protected" argument: like 80% of iPhone users do the fingerprint-unlock thing which keeps your kid sister out, but not a skilled hacker. – Mike Ounsworth Sep 1 '16 at 3:42
  • For enterprise, you can add "always ask for fingerprint or password" to open for all phones controlled by the enterprise. – Stone True Aug 18 '17 at 14:19
  • @StoneTrue Maybe that makes sense for corporate-issued (or maybe BYOD?) phone's, but even so, fingerprints don't count as security, and corporate environments typically require different passwords for different accounts, so you're essentially reducing all accounts to your phone's password (be single point of failure). – Mike Ounsworth Aug 18 '17 at 14:25
  • Yup - already have that though with the main network password though - our enterprise is moving to single-sign on with a TOTP second factor for some apps. – Stone True Aug 18 '17 at 14:29
  • @StoneTrue How does the Windows network password equate to our internal git server, internal payroll system, etc? The question was about Google Authenticator (presumably for Gmail, GitHub, etc) I feel we're getting into an oddly specific rabbit-hole. – Mike Ounsworth Aug 18 '17 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.