This question already has an answer here:

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code.

This goes against at least one intuitive line of reasoning -- it allows an attacker to check whether they have the right password before trying to attack two-factor authentication.

What are the trade-offs that make this a reasonable choice in Google's case, and in general? How should this inform similar questions in other spaces?

This question is about 2FA in general but Google is just a widely used example.

marked as duplicate by Benoit Esnard, Anders, Community Mar 5 '18 at 20:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


It prevents the attacker from knowing if you implement multifactor authentication, thus reducing the attack surface.

Edit: it also will allow you to be alerted if your password is compromised without allowing someone into your account. This will allow for user's who don't implement the security practice of unique passwords to resolve the issue before a breach occurs elsewhere.


This is a usability versus security issue. Not saying that the password was wrong until after you have authenticated through the app would indeed be slightly more secure. But on the other hand, it would not be a very positive user experience.

The security loss here is quite minimal, since Google is very good at blocking live brute force attempts. The password would need to be very bad, or the attacker would need to have some knowledge about it, for this to work.

So I can understand why Google opted for usability here. They want people to use 2FA, and the best way to convince people to do that is to give them a smooth user experience.

Not the answer you're looking for? Browse other questions tagged or ask your own question.