I was wondering if two factor authentication is really necessary if you are using high entropy, long, unique passwords for each site. From my experience 2fa just beefs up security a little more, by adding another key necessary to get into a lock. But if the first key is sufficient(20 plus characters), does it really matter?

I only log into sites on machines I trust so I am not super worried about keyloggers or malware that was previously installed on the machine.

It seems to me the main purpose of 2fa is to either pad bad passwords, or protect users against replay attacks.

  • 2
    A password can still be captured by malware, keylogging, or shoulder surfing. 2FA helps prevent a compromised password from leading to a compromised system.
    – GdD
    Feb 21, 2014 at 10:31

5 Answers 5


A better comparison is like having a guard inside a locked door. If you lose your key, the guard can still keep someone that isn't you from walking in. It isn't possible to guarantee that even the most secure password won't be compromised due to some attack.

Having multiple factors, particularly one that is never directly shared, adds an entire additional tier of security. You still gain a lot from two factor authentication and you still need it for the same reason you don't use a weak password when using two factor authentication.

The best security is using a strong version of both. We just don't bother with three factors because while one would be easy to compromise, two would be much more difficult to compromise at the same time and if they can get two at the same time, three isn't much harder.

  • That's more concise and to the point, I think. The original question seemed not to understand what "factor" means in this context, I got into that a little too much. Feb 21, 2014 at 2:43
  • so since the master key is never revealed does the 2fa acts more as a challenge response?
    – Joseph L.
    Feb 21, 2014 at 15:35
  • Depends on what your second factor is, it can be something you provide (like a fingerprint) but it can also be to provide evidence of something you have (like a one time key device that is actually proving you have a key). Feb 21, 2014 at 15:47
  • in the case of authenticator apps and tokens. the master key is needed by the website's server to know what the valid subkey is. so the problem exist that if there is a data breach at a website and the usernames,passwords,etc. get leaked won't that include these token master keys. the only way around this (from my understanding) is that the secrets would be handled by a third party, such as verisign or google. that way the secret is not lost with everything else when a single website is breached. but from my understanding, that is not the case (except verisign).
    – Joseph L.
    Feb 21, 2014 at 16:13
  • @JosephL. if the server is compromised, then the system is already compromised and being able to impersonate a user doesn't really matter. Feb 21, 2014 at 16:22

You can have the strongest password available, and perhaps you use it to log into Adobe. And then, lo, Adobe's encrypted passwords (BAD ADOBE! BAD! You should use PBKDF2, Bcrypt, or Scrypt for hashing passwords, you don't encrypt them!) are all leaked. Had the attackers also stolen the encryption key for those passwords, then the attacker would already have your long, random password.

If you also had two-factor authentication of some type, then while the attackers could instantly get into millions of other user's accounts, they would have another layer to crack before they could get at yours.

You would, of course, still have to change your password everywhere you use it.

The lesson: Never assume that your "trusted sites" have good password storage practices. Adobe didn't. Sony didn't.

  • 1
    Question - If you can't assume "trusted sites" have good practices, why should you assume their 2FA system follows good practices? After all, 2FA can be custom coded by anyone that wants to do it. If they don't secure their user's passwords properly, why do you expect 2FA to be implemented any better?
    – James Haug
    Jul 27, 2019 at 13:52

Things used to authenticate are typically "something you know" (a password), "something you have" (a physical key, an ID), or "something you are" (fingerprint, handprint, voice, etc)

The idea behind two-factor authentication is to use two of those domains rather than one.

No matter how complicated your one-factor password is, if I get it, I'm in. If it requires me to enter a code sent to a cellphone, then it requires possession of that phone (or intercept capability of its SMS messages, which are beyond my personal threat model) AS WELL as that password, it's anywhere from slightly more difficult (for a co-worker, roommate, etc) to practically impossible (somebody > 1 km away). If it requires the password + a token password, then I need to possess the token, same idea, etc...

As a bonus two-factor offers some protection against bad passwords.

As a user, I can't compromise myself by a single mistake (leaking my password, losing my phone or token). As an administrator, I have a much higher degree of confidence that user is who they claim to be.

Replay attacks, btw, can be prevented by single-factor one-time password schemes (S/KEY), which I don't see too frequently these days.

Also, regarding your "only sites I trust" -- just because you trust something doesn't mean you shouldn't protect yourself.


2FA is not the same as a password twice the length.

2FA means there are two different things protecting you, having one is a single point of failure.


Could your password be read by some other person with physical access to your device?

Could it be read by some application installed in your device which source code isn't available?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .