1

I'm wondering if there's any reason to implement a username/password with 2FA or, from the user's perspective, just settle with a username/2FA code. I'm trying to seek a healthy balance between the ease of a sign in process and not requiring a user to remember a (difficult) password.

Of course I know adding a password makes it more difficult but does it weigh out to the security something like Google Authenticater app also brings.

Any thoughts on this?

|improve this question|||||
  • 1
    If you do the latter, it's no longer 2FA since it only requires something you have (a phone/key generator), and not something you know (password). – multithr3at3d Apr 28 '18 at 16:03
1

I would not recommend omitting password. TOTP (what you call 2FA) is usally only 6 digits long, which is not recommended as strong enough. Another problem may be, that someone may have access to the persons phone for a short time. That is not a problem, if they would need password as well. The TOTP code would change quickly, so they can't write it down and wait till they will obtain the password. But it would be a problem if it does not, because they could just log-in immediately.

|improve this answer|||||
  • I see, that indeed is a very good point I didn't think about. Thank you. +1A – Ben Fransen Apr 28 '18 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.