These days, there's pretty much three forms of authentication in general use on the web:
- Single-factor authentication, e.g.: PIN or password.
- Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
- "Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.
Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".
So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?