3

I think the title says it all, but to elaborate:

If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery code, given enough time? Consequently, would it not be equally secure to just require a very long, and randomly generated password?

2 Answers 2

1

If, say, someone were to find my recovery code, could they not then gain access to my account?

As you said, this is only the one factor. That's why -most likely- the recovery codes are simple PINs and have limited time of life. If someone intercept this PIN they have to find out your real password.

Similarly, could then someone not just hack my recovery code, given enough time?

Limited time of life for recovery code is -mostly- for this reason. In the case of someone steal your account's credentials, he/she have a certain time to provide security code. That's a way to limit (not prevent) brute-force techniques.

Consequently, would it not be equally secure to just require a very long, and randomly generated password?

Even if you have a 24-digits password that've been randomly generated, you should think any other security threats that exists (e.g. If someone gain access in your password manager/computer/mobile).

You can find literally tons of articles that describe 2FA (or MFA (Multi Factor Authentication)) scenarios and what are the benefits that provide.

Also, to not confuse you with false sense of security by using 2FA, I better give you a -well known- case that didn't actually worked:

Reddit Got Hacked Thanks to a Woefully Insecure Two-Factor Setup:

Attackers got into Reddit’s systems by compromising some employee administrative accounts for company cloud storage and source code storage. Slowe notes in the blog post that the employees were using two-factor authentication to protect these crucial accounts, but some number of them had that layer of protection set up with SMS—meaning someone would need a code texted to their mobile number to complete an account login. The problem is that SMS-based two-factor is known to be insecure, because attackers can launch a “SIM swapping” attack to take control of a user’s SIM card and all the data coming to their phone number.
source

1
  • But recovery codes are "something you know", just like passwords (these days more like "something you have written down"). So 2FA has a built-in 1FA recovery option. I agree that having one-time-use codes is helpful, but seems like the # of "factors" is misleading.
    – Luke
    Dec 18, 2023 at 20:37
0

In general, recovery code is a one-time substitution for 2-nd factor only, so its compromise doesn't lead to compromise of account directly - you still need target user's password. And phishing is useless in this case due to one-time nature of recovery codes, so it's still better than just long passwords.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .