Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using a password and a TOTP, for example like Gmail, Facebook, ...etc
Is it still secure to use the same password on those services as long the second factor is different?
If that other factor is enough to protect your security for you, then sure. The point of multiple passwords is that if one is compromised, they aren't all compromised. If you reuse the password and one account is broken, that factor is broken everywhere it is used. If you don't mind a one time code being all that stands between an attacker and your Gmail account, then there is no reason not to use the same password. It is certainly far less secure, but it's also far more usable. It's a personal choice based on what you think the tradeoff is between security and usability.
While I mostly agree with @AJ Henderson, if one of the sites using multi-factor authentication breaks or changes their implementation, you are then at risk.
Beyond your question, as a general point, I urge people to use a password manager, in which case there's not a lot of value to using the same passwords.
You will make things easier for someone looking to compromise your password irrespective of that second factor. You're under the impression that any second factor will be more secure than the first. Think about that for a moment.
Imagine you put your trust in Acme Dual Factor company. You trust that they will be your "overseer" in the sense that you have one key, and they have the other. Chicken or the egg concept. If one was that secure, you wouldn't need the other.
What I have done to manage complex passwords each different across many systems is, I have made myself a mental framework to remember them. It's based on the "something you are, something you have, and something you know" concept.
Something I have: (A Gmail account) Gm@!l
Something I know: (password I choose) f!d0
Something I am: (from New York so I will use) y@nkees
"It would take a desktop PC about 3 quintillion years" https://howsecureismypassword.net/
Let's do this again.
Something I have: my bank login (C!t!b@nk)
Something I know: my phone number ... shifted - @)@%%%(*&^
Something I am: from New York
C!t!b@nk.@)@%%%(*&^.brooklyn
Not my bank, but Gmail:
GM@!l.@)@%%%(*&^.brooklyn
Hotmail?
H0tM@!l.@)@%%%(*&^.brooklyn
These are things I can NEVER forget. My phone number holding shift. Where I am from, and what is it I have. There are many mechanisms to commit to memory in order to remember ultra strong passwords. My Truecrypt password is 26 characters, my sign in, 21. Completely DIFFERENT passwords. I remember them all because I created my framework. I back them up using Keepass for safekeeping.
Now, someone will come along and say: "the vulnerability is in your framework" and I will point out, the odds of compromising ANY of those bits of data via say "social recon" is absurd.
