In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, say, a "lost password" flow).

My argument was, from a "moral" perspective, if you enable two factor, you need two factors to make any changes to an account - in the lost password case, the two factors would be access to your email + your second factor.

His argument was, even if you can reset the password with a single factor, two factor authentication is still doing its job: even if the attacker can change your password by gaining access to your email, the attacker is still unable to get into your account because of the second factor, thus, why do we need a second factor to reset?

Is there a logical fallacy here? How do you defend needing two factors to reset a lost password?

  • 7
    Because you lock out the legitimate user and start a password reset fight ...
    – schroeder
    Jan 25 '19 at 15:51
  • I have trouble understanding your question. Could you try to rephrase it?
    – Tom K.
    Jan 25 '19 at 15:51

This is a security measure that is implemented independently of 2FA. Many places require you to enter your current password when you want to change your password. Password reentry may also be required to change contact information and account recovery options.

The reason for this is to prevent unauthorized changes. If it is possible for users to leave a session unattended, then it is possible for another person to make changes to the account. The most sensitive settings relate to authentication, recovery, and contact information since those could grant ongoing access to a malicious actor.

In order to mitigate the risk associated with unattended sessions, most services implement an idle timeout, reauthentication for critical operations, or both.

  • 4
    The key point, in your last part: reauthentication for critical operations. When you have multi-factor authentication enabled, you need to supply all of the factors to authenticate. It's as simple as that.
    – CBHacking
    Jan 26 '19 at 0:09
  • While your suggestion is more secure, it is also inconvenient for users. There are always trade-offs, and password-only reauth is fairly common.
    – DoubleD
    Jan 28 '19 at 15:46
  • 2
    It's less inconvenient than to lose the account...
    – ThoriumBR
    Jul 24 '19 at 4:03

The topic is general enough, but the discussion here is limited to simplified situation where the first factor is a password and the second factor is something else. General answer would be that you should not be able to make modifications to multi-factor authentication factors with a single factor.

To make life simpler many MFA solutions allows you to trust a device and use less or single factor to authenticate you in the future. If someone gains access to a session that don't have MFA protection for such purposes, and can change other factors without access to them all simultaneously, that's not a MFA anymore.

In order to change an authentication factor you should have access to at least two independent factors. Many services do allow resetting passwords with two other factors: SMS and email. The problem here is that these factors aren't truly independent in practice, as email accounts are added to smartphones. When you get access to someones unlocked phone, you can first use it to reset the password and then use the password again to change all the other factors. While this is a different case, it might be an easy one to understand. Common to all these measurements is that they are here to prevent having a single point of failure.

Also, not all services are used as regularly as email. You might not realize someone has changed your password unless you try and use the service. This gives an attacker more time to gain access to the rest of the factors, unless stopped in advance by requiring all the factors simultaneously.


Same question for us right now, my conclusion:

3 Ideas

  • typing in the email address only works in combination with 2FA Code, clicking the link and changing the password does not require the code but is time limited.

  • requesting a password works without 2FA code, but changing the password requires the 2FA

  • (bonus, combo of both)

  • none does require 2FA, because the login is still protected

Last idea is stupid, simply because now the attacker already knows the (changed) password and just needs to bruteforce the 2FA Code (most likely 6 digits) which is indeed possible. This could also be abused for bruteforcing a list of emails, to figure out if an account exists or not, so your form needs to be captcha protected.

i think 1 or 2 is the way to, but probably both in combo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.