I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight).


I have a typical web application forms authentication process with two steps:

  • Step 1: Request username and password
  • Step 2: Request some characters (for example, 2nd, 5th and 8th) from a secret phrase

Should I authenticate the username and password before going to Step 2? Or should I collect all three bits of information (username, password and characters) and check them at the end?

Most websites I've seen check the username and password and if they don't authenticate, never ask for the characters. On the other hand, it could be argued that checking everything at the end and if they don't match, displaying an error message that doesn't explain which bit failed would be more secure. That gives away less information like displaying "Username or password is incorrect" (without specifying which) in a simple 1 step authentication.

The problem with the second approach (aside from being less user-friendly) is that Step 2 requires obtaining a valid user in Step 1, otherwise it's hard to know the length of the secret phrase to ask for valid characters (there's no point asking for the 10th character if the phrase is only 9 characters long). The application would also have to hold on to the password in a secure manner between the two steps.

So which one is better? Is there a third approach I should consider?

  • 1
    Can you give us some background as to why you are using a two-step process? What threat model is this helping you protect against? Jun 20, 2014 at 10:54
  • I think it's there to meet a (vague) client requirement. Does that help? :) Seriously now, the internet banking site I use does a similar thing (using the first method, btw) so surely I'm not the only one out there.
    – acfrancis
    Jun 20, 2014 at 11:06
  • Are you talking about a random character challenge? Shouldn't the letter selected be based within the range of the minimum length? E.g., if you require at least 6 then only ever request 1, 3, 5 or 2,3,6 - if you change it based on the lenth of the secret you will give away which users have more complex secrets.
    – Eric G
    Jun 20, 2014 at 13:09
  • True but if the app doesn't use more than the minimum, it's not just a minimum, it's also the maximum. In other words, the secret phrase must be x characters long.
    – acfrancis
    Jun 20, 2014 at 13:19

2 Answers 2


Don't do this! This is stupid. If it is a client requirement, push back on the client. You are supposed to be the expert. Tell the client when they are doing something that doesn't serve their interests. This is simply an elaborate single factor authentication and provides absolutely zero additional security over a slightly longer password requirement.

The client may think that this is a second factor, but it is not. For two factor authentication it must be two DIFFERENT factors from something you have, something you know and something you are. These are both something you know, so no additional security is provided beyond the extra characters on the password, it is just a little more convenient that having to type the entire phrase (which is basically a long but very weakly chosen password). It also has no impact on preventing hash attacks against the stored password (and online brute force shouldn't be possible due to account lock outs.)

If the client still wants this despite the lack of any actual security benefit, I don't see any way not to do it as two steps since, as you point out, you don't know how many characters to choose from unless you know the length of the phrase that it is going to be working off of and hopefully at least the secret phrase is protected by their password (though I somehow doubt it).

  • +1. This is not a good idea, there is no real reason to be having this second step. Either the user knows the password and is authenticated after the first step, or... or not. Why even bother with asking additional letters? This does not add any level of security. Some banks used to do this a few years ago, when they bought into the snake oil that his counts as a "second factor". It does not.
    – AviD
    Jun 20, 2014 at 12:58
  • To be fair to banks, the secret characters can be used as an additional security check over the phone (when speaking to a person) but that's not relevant in my case.
    – acfrancis
    Jun 20, 2014 at 13:07
  • Assuming we keep it in two steps, would you check the password before asking for the secret characters? Technically, you can ask for secret characters even if the username is invalid. My main concern is that I need to store the password somewhere between the user submitting Step 1 and Step 2.
    – acfrancis
    Jun 20, 2014 at 13:12
  • 1
    @acfrancis - what it really is is theater. The level of randomness that most people are going to put in to choosing a phrase is likely pretty small, so the actual entropy of such an additional check is going to be pretty small, even for the length. A little social engineering is also likely to overcome it as people don't understand how the security measure is supposed to work. It might be slightly better than no additional info being needed over the phone, but not by much, it is mostly for show so that people FEEL like their money is being protected. Just like "enhanced" airport security. Jun 20, 2014 at 13:12
  • @acfrancis - it probably needs to be two calls. You don't want to leak the length of the passphrase to an attacker who doesn't have the password yet. As an alternative to storing the password in session, decode the passphrase and store the phrase instead. Jun 20, 2014 at 13:14

Typically a multifactor challenge happens either after password authentication or at the same time.

I don't think telling your customers what went wrong during login is going to hurt your security so much that it justifies the amount of frustration that you'll be subjecting them to if you don't tell them what went wrong.

If they misspelled their username, or their account is locked, that is useful information for them to have. Telling them that the password is wrong, doesn't weaken the password. Telling them that the MFA challenge failed, doesn't weaken the MFA.

Wrong username can be discovered usually anyways by the 'i forgot my ' anyways, so streamlining the process for forgetful human beings would be appreciated, instead of locking their account.

For working from home this morning, I logged in with multifactor and since it is conditional to where I log in (in the office I don't have to MFA), MFA happens after normal authentication as a second step.

For logging into my password manager from a non-trusted machine, I require MFA, and that comes as a second stage, not the same stage. Making it a second stage of authentication lets you make it conditional. Not everyone with my password manager chooses to require MFA. In this way you can turn it off for people that don't appreciate it.

Oh and I agree with AJ Henderson, that second stage using random chars from a secret word is a mickey mouse idea from someone that doesn't know what they are doing. So if you're doing that instead of true MFA, its a placebo anyways, don't worry too much about it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .