Two-factor or multi factor authentication is based on three possible forms of authentication:
- Something you know which is considered secret (password)
- Something you have (token, SMS token, card,...)
- Something you are (biometrics)
If either two of these three are combined, you can speak of two-factor authentication. Saying two things you know (such as two passwords or username and password) IS NOT two factor authentication.
- You can use as an identifier but you cannot use it as the secret (if you plan to use it as the "password").
- Password resets will depend on the procedure in place. It can be the same as with a password, you just get a reset link in your email. This doesn't mean the second factor is altered! The password should preferably not be changed based on another factor of authentication (especially applicable in case of something you have in case of theft).
- Yes, but you should ensure that the token is only limited for a certain period.