I have a debate with a colleague about using the same kind of authentication factor twice (like using two passwords). My question is if it falls under the definition of "strong authentication".

I know that most of you will say that 2 factor authentication is much better than using the same kind of factor, but as I am reviewing it against a contract that specifies "Strong authentication" (and not 2FA), I wanted to know if you think it is can be considered as strong authentication.

Needless to say that we are talking about two sets of UIDs and passwords.

  • 1
    "strong authentication" is always going to be subjective, but from your OP it is hard to tell what is the use case - data, users, etc. to determine the risk. What is reasonable or appropriate will determine the use case. It would probably be better to have the contract re-written so this is more clear and to avoid ambiguity and arguments latter. – Eric G Jan 6 '18 at 3:27

If the contract calls for "strong authentication" I think that's open to interpretation. It also depends on the type of information you're protecting and how that information is being accessed. My bank for instance, doesn't require two factor authentication to access my money, only a strong password.

To answer your question, I don't think requiring two sets of usernames and passwords is any more secure than just one. The benefit of true two factor authentication is that if one factor is compromised, the other most likely isn't. Having two usernames and passwords is pointless if a users desktop is compromised.

  • Hi and thank you for the quick answer ! . One thing that I forgot to explain about is the flow : Login to the machine with one UID and PW , connecting to a server , and then using another UID and PW to log into that server .( by the way , the server resides on a remote network , and the connection to that network is being done through site-to-site VPN . ) Does that change anything? – RafiG Jan 5 '18 at 21:24

Putting aside the contract language and dealing with the question as stated, no, what you have described is not "strong" authentication, but authentication twice. If the design of both is poor, then putting them together does not make them stronger.

You could make a case for it to be seen as "2 factor" but you would have to survive the risk of an expert thinking that you really do not know what you are doing and losing trust with them.

Strong authentication can be achieved with your specific architecture with a strong authentication mechanism. Encrypted channel, server-side hashed and salted passwords, lockout policies, and meta-policies dealing with proper authorisation of accounts and authentication event reviews/monitoring. Chances are, you are doing all those things anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.