I recently signed into an account on a website using my Google account. I already have an username+password account on the website, where I have also enabled 2FA with a TOTP code. Upon signing in with my Google account, I noticed I wasn't prompted for my TOTP code (the website's - not for Google).

If I log in using my username and password, it prompts me for a TOTP code. I can bypass this by signing in with my Google account. I know that OAuth moves the security aspect to the 3rd party, but in my opinion, I should get prompted for a TOTP code on the website I'm signing into. Say my Google account gets hacked (or someone steals my unlocked phone), they instantly have access to all websites with OAuth sign in options.

I understand the pros and cons, but I still think it's odd the website doesn't ask me for TOTP, just because I signed in using OAuth.

What is the general consensus/thought on this? Is it up to each website to decide?

1 Answer 1


The whole point of using an IdP (Identity Provider) and SSO (Single Sign On) at all is central authentication and improving security by doing so. If every Relying Party would require an additional authentication factor, the advantage in using SSO is gone.

Google uses OpenID Connect (OIDC) which is based on OAuth 2.0. OIDC introduces a special token, the ID Token. The ID token might contain information about how the user was authenticated in the amr and the acr claims, so the RP is able to decide if this is a strong authentication method. The RP might also request certain level of authentication in the acr_values authentication request parameter.

Of course the Relying Party relies on the security and integrity of IdP. But the IdP is also able to implement much better security features in comparison to the average RP. Well implemented SSO might improve security drastically by making 2FA usage easier for users or even enforcing 2FA at a central point in the system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .