First off, the solution you describe in your blog post is not two factor authentication. You have two 'something you know' factors: your password and your special image.
(edited with updates to answer the extended question, 'can single factor authentication provide the security of multifactor authentication.'
Second, there appears to be some confusion about what authentication factors are. Authentication factors are 'something you know,' 'something you have', and 'something you are'. Something you know is something that you store in your brain. Passwords are the most common example, but it includes anything and everything that relies on your memory to know. You use your brain to remember your password. You use your brain to remember what image you selected.
Something you are refers to stuff about you that is inherent to you being you. Biometrics Are the most common example here. Your retina shape, your finger print, etc.
Something you have is a physical object in your possession. Examples include mobile phones, hardware tokens, certificates, printed challenge response 'bingo' cards, your car, etc.
You only get multi-factor authentication when you combine something you know, something you have, and something you are. You do not get multifactor authentication when you combine multiple elements of the same factor. A password and securid token combined make for multifactor authentication, because you know one and have the other. Two passwords combined makes single factor authentication because you know both. A password and pre-selected image combined is single factor authentication because you know both.
Third, no, single factor authentication does not provide the same security as multifactor authentication, no matter how hard you try. Different factor, by their very nature, provide different assurances.
Something you know is easy to remember - it must be in order to scale across many users. This makes it easy to provision. You don't have to physically distribute anything like a hardware fob, just ask people to remember a password. It's easy to forget a password and require reprovisioning. It's also somewhat hard to steal, since you can't dig into someone's brain and just take their memory, but theft does not require proximity (monitoring network traffic is enough to steal a password), key loggers work against it, and it's hard to detect that it's stolen. It's also easy to replace - just set a new password and be done.
Something you have is something you carry with you. This makes it harder to provision, since you now have to physically distribute a piece of hardware to everyone (or the equivalent with certificates), though this may be possible with mail or trusted courier. It typically requires expensive infrastructure, though cell phones carried by everyone mitigates that cost. It's easy to forget your hardware device at home, or at the main office during travel, etc, which requires backup infrastructure for temporary provisioning. Something you have is easier to physically steal, though now it requires physical proximity to take your hardware device out of your pocket. It's easy to detect that tit's stolen, since it is no longer in your possession. It's hard to replace, since you must re-provision with that expensive process.
Something you are is hard to provision - you need special, often expensive equipment to collect biometrics from your users. Your users may find that creepy, and might resist collection. You need physical proximity to collect samples. It's impossible to forget to bring biometrics with you - they are you! Depending upon the biometric, it can be difficult or easy to steal, but it's never secret. Your dna is left everywhere, fingerprints are left everywhere, retina is temporarily anywhere you look. Something you are is impossible to replace. You have two eyes, 5fingers (unless you have a birth defect or lost one or more fingers in an injury) and can never get new ones, so if they are compromised you cannot be reprovisioned new credentials. Nor can you get new credentials of the same type if you lose them all - if you lose both hands, you have no more finger prints.
You get strength by combining multiple factors, because this offsets the weaknesses of one factor. With only something(s) you know, you only get the strengths of what you know. Add some hardware that you have, and now theft becomes obvious at the expense of cost and usability.
Fourth, Yes, you can use things other than your mobile phone for multi-factor authentication. Phones are just used a lot because they are with everyone and don't require carrying a separate physical object, like a watch, hardware token, cardboard challenge card, etc.
Fifth, your solution sounds very much like passkey (based on your blog; I was not willing to provide my email to sign up for your service). I believe I've heard of this solution in another product as well. Are you sure you haven't recreated someone else's work? Are you sure your solution is devoid of patent challenges?
Sixth, your solution may well have many issues. Just off the top of my head, in about 10 minutes, here's a starting list...
- If you do not always show the same set of images, the attacker can simply try to authenticate many times and watch what images don't change. One of them must be the right one.
- If you do always show the same set of images, the attacker can try them one at a time
- If you show too many images, it will reduce usability. If you don't show enough images, the picture effectively adds no security.
- If the real image is located in the same location for every user, or in s predictable location for each authentication (like using rand() to choose the location), the attacker won't even need to know the image, they will just need to predict the next location and enter the location id.
- The images are 'public' in that they are always shown pre-authentication, after being shown an email address. If a user uses the same image at multiple sites, so s/he can remember it, and those sits show different images on the challenge page, this helps the attacker - only the images common to both sites are likely to be the correct one.
- A naïve solution following your description allows the attacker to enumerate all valid accounts by presenting the challenge if the email is entered. What happens if the account doesn't exist? Are random images shown every time? Just like number 1 of this list, if all images rotate off the selection list at some point, the attacker will know that the account doesn't exist. You need to do the math to demonstrate that the performance is low enough compared to the size of the userbase that a system-wide brute force attack will not be successful in a reasonable amount of time, or you need to not leak logins. Since your solution doesn't exist on s system yet, and is meant as s general purposes solution, you cannot predict the performance of the target server which makes your solution very difficult to prove username enumeration happens to be safe.
- Because you are using images, you cannot prevent shoulder surfing on the set of images. This needs to be evaluated for impact to your solution.
- Are you preventing shoulder surfing against the selected image entry field?
- If you lock out accounts due to bad authentications, you present a denial of service attack against the system. You also only slow down an attack, not prevent it. Once you unlock the account, the attack can begin again.
- I saw no mathematical proof of the strength of your visual-password solution. Without such proof (which is not hard to do, given the attack optimizations herein) your solution is be default not trustworthy.
- What prevents the user from selecting a password that represents the image? For example, the password "trees" for an image of trees? Not addressing this will make for a new and interesting optimization for the attacker.