In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, say, a "lost password" flow).

My argument was, from a "moral" perspective, if you enable two factor, you need two factors to make any changes to an account - in the lost password case, the two factors would be access to your email + your second factor.

His argument was, even if you can reset the password with a single factor, two factor authentication is still doing its job: even if the attacker can change your password by gaining access to your email, the attacker is still unable to get into your account because of the second factor, thus, why do we need a second factor to reset?

Is there a logical fallacy here? How do you defend needing two factors to reset a lost password?

  • 8
    Because you lock out the legitimate user and start a password reset fight ...
    – schroeder
    Commented Jan 25, 2019 at 15:51
  • I have trouble understanding your question. Could you try to rephrase it?
    – Tom K.
    Commented Jan 25, 2019 at 15:51

3 Answers 3


This is a security measure that is implemented independently of 2FA. Many places require you to enter your current password when you want to change your password. Password reentry may also be required to change contact information and account recovery options.

The reason for this is to prevent unauthorized changes. If it is possible for users to leave a session unattended, then it is possible for another person to make changes to the account. The most sensitive settings relate to authentication, recovery, and contact information since those could grant ongoing access to a malicious actor.

In order to mitigate the risk associated with unattended sessions, most services implement an idle timeout, reauthentication for critical operations, or both.

  • 5
    The key point, in your last part: reauthentication for critical operations. When you have multi-factor authentication enabled, you need to supply all of the factors to authenticate. It's as simple as that.
    – CBHacking
    Commented Jan 26, 2019 at 0:09
  • While your suggestion is more secure, it is also inconvenient for users. There are always trade-offs, and password-only reauth is fairly common.
    – DoubleD
    Commented Jan 28, 2019 at 15:46
  • 3
    It's less inconvenient than to lose the account...
    – ThoriumBR
    Commented Jul 24, 2019 at 4:03
  • The problem always has been that convenience is against security (just think of trivial short passwords).
    – U. Windl
    Commented Dec 27, 2023 at 11:45

The topic is general enough, but the discussion here is limited to simplified situation where the first factor is a password and the second factor is something else. General answer would be that you should not be able to make modifications to multi-factor authentication factors with a single factor.

To make life simpler many MFA solutions allows you to trust a device and use less or single factor to authenticate you in the future. If someone gains access to a session that don't have MFA protection for such purposes, and can change other factors without access to them all simultaneously, that's not a MFA anymore.

In order to change an authentication factor you should have access to at least two independent factors. Many services do allow resetting passwords with two other factors: SMS and email. The problem here is that these factors aren't truly independent in practice, as email accounts are added to smartphones. When you get access to someones unlocked phone, you can first use it to reset the password and then use the password again to change all the other factors. While this is a different case, it might be an easy one to understand. Common to all these measurements is that they are here to prevent having a single point of failure.

Also, not all services are used as regularly as email. You might not realize someone has changed your password unless you try and use the service. This gives an attacker more time to gain access to the rest of the factors, unless stopped in advance by requiring all the factors simultaneously.


Same question for us right now, my conclusion:

3 Ideas

  • typing in the email address only works in combination with 2FA Code, clicking the link and changing the password does not require the code but is time limited.

  • requesting a password works without 2FA code, but changing the password requires the 2FA

  • (bonus, combo of both)

  • none does require 2FA, because the login is still protected

Last idea is stupid, simply because now the attacker already knows the (changed) password and just needs to bruteforce the 2FA Code (most likely 6 digits) which is indeed possible. This could also be abused for bruteforcing a list of emails, to figure out if an account exists or not, so your form needs to be captcha protected.

i think 1 or 2 is the way to, but probably both in combo.

  • On "and just needs to bruteforce the 2FA Code (most likely 6 digits) which is indeed possible.": Assuming we talk about TOPT that is based on HOTP, then RFC 4226 says in "7.3. Throttling at the Server" that the number of attempts should be limited, or there should be a significant delay ("...*setting a throttling parameter T, which defines the maximum number of possible attempts for One-Time Password validation.*...", "...*Another option would be to implement a delay scheme to avoid a brute force attack*...").
    – U. Windl
    Commented Dec 27, 2023 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .