Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the purpose of typing in data which is not permanent, like SMS message which comes to you when you are logging in. You don't know it before it comes. So, is answering remembered security questions is 2FA according to 2FA principles and the framework of security questions?
There are main 3 factors
- Something You know - Password, Question, PIN..etc (Type 1)
- Something you have - Token, Smart card...etc (Type 2)
- Something you are - Iris scan, Fingerprint...etc (Type 3)
If you want to multifactor you can use combination of them. Security question and password are in same category. That mean it is not a two factor.
In addition that
- Somewhere you are
- Somewhere you are not
also consider as deferent factors. You can use combination of these factors as well. Then it will become multi-factor.
Security questions, such as "what is the name of your first pet?" are not 2FA because they substitute to your password.
In 2FA, you need to input the two factors to authenticate (log in). For example, you need to type your password and present a badge. Or type a password and then type a PIN code you receive by SMS or read on an electronic token. Thus, the overall strength of the authentication is the combination (multiplication of combinations, or sum of entropy) of the two factors.
Security questions, on the other hand, substitutes to your primary authentication method (in the following, I'll suppose it's a password, but it works the same with any authentication method). If you do not know the password (because you forgot it or because you try to break in), you can instead input a "security answer". Knowing or guessing either the password or the "security answers" is enough to authenticate. Therefore, the overall strength of the authentication is the weakest (the minimum) of the two factors. That's why "security questions" are a security anti-pattern that usually weaken the overall security.
Security question can only substitute to a password: they are something you know because you do not need a specific object to answer them (not something you have) and anybody knowing the response can anwser (not something you are).
But you should be aware that they are now seen as a poor quality password substitution. Because as you should remember them easily, people knowing you, or finding information on social medias could guess the answers. For example, they are known to have allowed the compromission of Sara Palin's mail account.
So being a poor way of doing something you know, you should better avoid them, and avoid to put them in a multifactor authentication procedure, which is expected to be based on secure components.