I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator alone (my 2-factor authentication method). I was wondering if this is a possible misuse of this concept of multi-factor authentication.

  • subjective question, but use a password manager to avoid such problems.
    – dandavis
    Mar 6 '20 at 20:28

It depends on the protection requirements of the website. When you talk about multi-factor authentication, you distinguish between different types of factors:

  • Something you know (e.g. a password)
  • Something you have (e.g. an authenticator)
  • Something you are (e.g. fingerprint)

How many of these factors are required, can be decided based on the protection requirements. If the website is fine with a single factor, proving that you own the authenticator is OK. If the website requires 2 factors (e.g. password AND authenticator), but you are able to log in with only the authenticator, you have found a security defect.

This means the answer is, it depends.

Sidenote: In case your browser is already known to the website, because you successfully authenticated with the same user in this browser before, the requirements concerning the amount of factors might have been deliberately reduced. This is done by some websites to improve the user experience.

  • Sounds dangerous. There's a little bit if a risk of collision if the code is used in place of a password. Someone else may have the code at the same time
    – Pheric
    Mar 7 '20 at 1:25
  • Independent of the factors you are using, you will always supply your user id / user name as well. So an accidental collision isn't a problem - like it isn't a problem when two users have the same password. Of course the general risk is higher with fewer factors, but that's basically what my answer is about.
    – Demento
    Mar 7 '20 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.